deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28641
Published: 2020-12-22
Description: In Malwarebytes Free 4.1.0.56, a symbolic link may be used delete an arbitrary file on the system by exploiting the local quarantine system.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59
References: https://support.malwarebytes.com/hc/en-us/articles/[PII_REDACTED]01-Arbitrary-file-deletion-vulnerability-fixed-in-Malwarebytes-Endpoint-Protection; https://support.malwarebytes.com/hc/en-us/articles/[PII_REDACTED]74-Arbitrary-file-deletion-vulnerability-fixed-in-Malwarebytes-for-Windows; https://www.malwarebytes.com
CVE: CVE-2020-35656
Published: 2020-12-23
Description: Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/jaws-project/jaws; https://github.com/xNoBody12/Jaws-CMS-RCE; https://github.com/jaws-project/jaws
CVE: CVE-2020-35657
Published: 2020-12-23
Description: Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS (aka Job Access With Speech) product.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/jaws-project/jaws; https://github.com/xNoBody12/jaws-rce-via-theme; https://github.com/jaws-project/jaws
CVE: CVE-2020-35658
Published: 2020-12-23
Description: SpamTitan before 7.09 allows attackers to tamper with backups, because backups are not encrypted.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312, CWE-552
References: https://docs.titanhq.com/en/13161-spamtitan-release-notes.html; https://secator.pl/index.php/2020/12/23/cve-2020-35658/; https://docs.titanhq.com/en/13161-spamtitan-release-notes.html
CVE: CVE-2020-25153
Published: 2020-12-23
Description: The built-in web service for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower does not require users to have strong passwords.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE: CVE-2020-25190
Published: 2020-12-23
Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower stores and transmits the credentials of third-party services in cleartext.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE: CVE-2020-25192
Published: 2020-12-23
Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows sensitive information to be displayed without proper authorization.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE: CVE-2020-25194
Published: 2020-12-23
Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has improper privilege management, which may allow an attacker with user privileges to perform requests with administrative privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE: CVE-2020-25196
Published: 2020-12-23
Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower allows SSH/Telnet sessions, which may be vulnerable to brute force attacks to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE: CVE-2020-25198
Published: 2020-12-23
Description: The built-in WEB server for MOXA NPort IAW5000A-I/O firmware version 2.1 or lower has incorrectly implemented protections from session fixation, which may allow an attacker to gain access to a session and hijack it by stealing the user’s cookies.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384, CWE-384
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-287-01
CVE: CVE-2020-35136
Published: 2020-12-23
Description: Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-88
References: http://bilishim.com/2020/12/18/zero-hunting-2.html; https://github.com/Dolibarr/dolibarr/commit/4fcd3fe49332baab0e424225ad10b76b47ebcbac; https://github.com/Dolibarr/dolibarr/releases
CVE: CVE-2020-35584
Published: 2020-12-23
Description: In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any information the user supplies, including Administrator passwords and screen keys.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://documentation.mersive.com/content/pages/release-notes.htm; https://github.com/aress31/solstice-pod-cves; https://www.mersive.com/uk/products/solstice/
CVE: CVE-2020-35585
Published: 2020-12-23
Description: In Solstice Pod before 3.3.0 (or Open4.3), the screen key can be enumerated using brute-force attacks via the /lookin/info Solstice Open Control API because there are only 1.7 million possibilities.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://documentation.mersive.com/content/pages/release-notes.htm; https://github.com/aress31/solstice-pod-cves; https://www.mersive.com/uk/products/solstice/
CVE: CVE-2020-35586
Published: 2020-12-23
Description: In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?[CREDENTIAL_REDACTED] Open Control API because there is no complexity requirement (e.g., it might be all digits or all lowercase letters).
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://documentation.mersive.com/content/pages/release-notes.htm; https://github.com/aress31/solstice-pod-cves; https://www.mersive.com/uk/products/solstice/
CVE: CVE-2020-11718
Published: 2020-12-23
Description: An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and below. Its software-update packages are downloaded via cleartext HTTP.
CVSS Score: 7.4 (HIGH)
CWE: CWE-319
References: http://packetstormsecurity.com/files/160627/Programi-Bilanc-Build-007-Release-014-31.01.2020-Insecure-Downloads.html; http://seclists.org/fulldisclosure/2020/Dec/39; http://packetstormsecurity.com/files/160627/Programi-Bilanc-Build-007-Release-014-31.01.2020-Insecure-Downloads.html
CVE: CVE-2020-11720
Published: 2020-12-23
Description: An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. During the installation, it sets up administrative access by default with the account admin and password 0000. After the installation, users/admins are not prompted to change this password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/160623/Programi-Bilanc-Build-007-Release-014-31.01.2020-Weak-Default-Password.html; http://seclists.org/fulldisclosure/2020/Dec/34; http://packetstormsecurity.com/files/160623/Programi-Bilanc-Build-007-Release-014-31.01.2020-Weak-Default-Password.html
CVE: CVE-2020-29550
Published: 2020-12-23
Description: An issue was discovered in URVE Build 24.03.2020. The password of an integration user account (used for the connection of the MS Office 365 Integration Service) is stored in cleartext in configuration files as well as in the database. The following files contain the password in cleartext: Profiles/urve/files/sql_db.backup, Server/data/pg_wal/[PII_REDACTED]00000A000000DD, Server/data/base/16384/18617, and Server/data/base/17202/8708746. This causes the password to be displayed as cleartext in the HTML code as roomsreservationimport_password in /urve/roomsreservationimport/roomsreservationimport/update-HTML5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312
References: http://packetstormsecurity.com/files/160726/URVE-Software-Build-24.03.2020-Information-Disclosure.html; http://seclists.org/fulldisclosure/2020/Dec/49; https://urve.co.uk/system-rezerwacji-sal
CVE: CVE-2020-29551
Published: 2020-12-23
Description: An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the following files and scripts are also accessible: _internal/pc/abort.php, _internal/pc/restart.php, _internal/pc/vpro.php, _internal/pc/wake.php, _internal/error_u201409.txt, _internal/runcmd.php, _internal/getConfiguration.php, ews/autoload.php, ews/del.php, ews/mod.php, ews/sync.php, utils/backup/backup_server.php, utils/backup/restore_server.php, MyScreens/timeline.config, kreator.html5/test.php, and addedlogs.txt.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: http://packetstormsecurity.com/files/160725/URVE-Software-Build-24.03.2020-Missing-Authorization.html; http://seclists.org/fulldisclosure/2020/Dec/48; https://urve.co.uk/system-rezerwacji-sal
CVE: CVE-2020-29552
Published: 2020-12-23
Description: An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/160722/URVE-Software-Build-24.03.2020-Authentication-Bypass-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Dec/47; https://urve.co.uk/system-rezerwacji-sal
CVE: CVE-2020-35587
Published: 2020-12-23
Description: In Solstice Pod before 3.0.3, the firmware can easily be decompiled/disassembled. The decompiled/disassembled files contain non-obfuscated code. NOTE: it is unclear whether lack of obfuscation is directly associated with a negative impact, or instead only facilitates an attack technique
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://attack.mitre.org/techniques/T1444/; https://documentation.mersive.com/content/pages/release-notes.htm; https://github.com/aress31/solstice-pod-cves
CVE: CVE-2020-35650
Published: 2020-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgm_code_redeem POST Parameter in user-code-redemption.php, the ulgm_user_first POST Parameter in user-registration-form.php, the ulgm_user_last POST Parameter in user-registration-form.php, the ulgm_user_email POST Parameter in user-registration-form.php, the ulgm_code_registration POST Parameter in user-registration-form.php, the ulgm_terms_conditions POST Parameter in user-registration-form.php, the _ulgm_total_seats POST Parameter in frontend-uo_groups_buy_courses.php, the uncanny_group_signup_user_first POST Parameter in group-registration-form.php, the uncanny_group_signup_user_last POST Parameter in group-registration-form.php, the uncanny_group_signup_user_login POST Parameter in group-registration-form.php, the uncanny_group_signup_user_email POST Parameter in group-registration-form.php, the success-invited GET Parameter in frontend-uo_groups.php, the bulk-errors GET Parameter in frontend-uo_groups.php, or the message GET Parameter in frontend-uo_groups.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/michiiii/81d801f563138abe7da61e2d95342202; https://www.uncannyowl.com/knowledge-base/uncanny-learndash-groups-changelog/; https://gist.github.com/michiiii/81d801f563138abe7da61e2d95342202
CVE: CVE-2020-6159
Published: 2020-12-23
Description: URLs using “javascript:” have the protocol removed when pasted into the address bar to protect users from cross-site scripting (XSS) attacks, but in certain circumstances this removal was not performed. This could allow users to be socially engineered to run an XSS attack against themselves. This vulnerability affects Opera for Android versions below 61.0.3076.56532.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.opera.com/cross-site-scripting-in-ofa-opera-security-advisories/; https://security.opera.com/cross-site-scripting-in-ofa-opera-security-advisories/
CVE: CVE-2020-9439
Published: 2020-12-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the search_key GET Parameter in TinCan_Content_List_Table.php, message GET Parameter in licensing.php, tc_filter_group parameter in reporting-admin-menu.php, tc_filter_user parameter in reporting-admin-menu.php, tc_filter_course parameter in reporting-admin-menu.php, tc_filter_lesson parameter in reporting-admin-menu.php, tc_filter_module parameter in reporting-admin-menu.php, tc_filter_action parameter in reporting-admin-menu.php, tc_filter_data_range parameter in reporting-admin-menu.php, or tc_filter_data_range_last parameter in reporting-admin-menu.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/michiiii/9501b878e7ba3c9fc2a7407ff8277fa5; https://www.uncannyowl.com/knowledge-base/tin-canny-learndash-reporting-changelog/; https://gist.github.com/michiiii/9501b878e7ba3c9fc2a7407ff8277fa5
CVE: CVE-2[PII_REDACTED]
Published: 2020-12-23
Description: Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving messages with invalid checksums.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bitcoinsv.io/2019/03/01/denial-of-service-vulnerabilities-repaired-in-bitcoin-sv-version-0-1-1/; https://bitcoinsv.io/2019/03/01/denial-of-service-vulnerabilities-repaired-in-bitcoin-sv-version-0-1-1/
CVE: CVE-2[PII_REDACTED]
Published: 2020-12-23
Description: Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when receiving sendheaders messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bitcoinsv.io/2019/03/01/denial-of-service-vulnerabilities-repaired-in-bitcoin-sv-version-0-1-1/; https://bitcoinsv.io/2019/03/01/denial-of-service-vulnerabilities-repaired-in-bitcoin-sv-version-0-1-1/
CVE: CVE-2[PII_REDACTED]
Published: 2020-12-23
Description: Bitcoin SV before 0.1.1 allows uncontrolled resource consumption when deserializing transactions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://bitcoinsv.io/2019/03/01/denial-of-service-vulnerabilities-repaired-in-bitcoin-sv-version-0-1-1/; https://bitcoinsv.io/2019/03/01/denial-of-service-vulnerabilities-repaired-in-bitcoin-sv-version-0-1-1/
CVE: CVE-2020-11719
Published: 2020-12-23
Description: An issue was discovered in Programi Bilanc build 007 release 014 31.01.2020 and possibly below. It relies on broken encryption with a weak and guessable static encryption key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://packetstormsecurity.com/files/160625/Programi-Bilanc-Build-007-Release-014-31.01.2020-Static-Key.html; http://seclists.org/fulldisclosure/2020/Dec/35; http://packetstormsecurity.com/files/160625/Programi-Bilanc-Build-007-Release-014-31.01.2020-Static-Key.html
CVE: CVE-2020-4642
Published: 2020-12-23
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow local attacker to cause a denial of service inside the "DB2 Management Service".
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185589; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/6391652
CVE: CVE-2020-13968
Published: 2020-12-23
Description: CRK Business Platform <= 2019.1 allows can inject SQL statements against the DB on any path using the 'strSessao' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://crk.com.br/produtos/; https://github.com/r3naissance/nse/blob/master/http-vuln-cve2020-13968.nse; http://crk.com.br/produtos/
CVE: CVE-2020-13969
Published: 2020-12-23
Description: CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK', 'IDContratante', 'Erro', or 'Mod' parameter. This is path-independent.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/r3naissance/nse/blob/master/http-vuln-cve2020-13969.nse; https://github.com/r3naissance/nse/blob/master/http-vuln-cve2020-13969.nse
CVE: CVE-2020-27397
Published: 2020-12-23
Description: Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution (RCE) on the Hosting web server via uploading a maliciously crafted PHP file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://packetstormsecurity.com/files/160337/Online-Matrimonial-Project-1.0-Remote-Code-Execution.html; https://packetstormsecurity.com/files/160337/Online-Matrimonial-Project-1.0-Remote-Code-Execution.html
CVE: CVE-2020-28070
Published: 2020-12-23
Description: SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_event.php via the 'id' parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/160583/Alumni-Management-System-1.0-Blind-SQL-Injection.html; http://packetstormsecurity.com/files/160583/Alumni-Management-System-1.0-Blind-SQL-Injection.html
CVE: CVE-2020-28071
Published: 2020-12-23
Description: SourceCodester Alumni Management System 1.0 is affected by cross-site Scripting (XSS) in /admin/gallery.php. After the admin authentication an attacker can upload an image in the gallery using a XSS payload in the description textarea called 'about' and reach a stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/160591/Alumni-Management-System-1.0-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/160591/Alumni-Management-System-1.0-Cross-Site-Scripting.html
CVE: CVE-2020-28073
Published: 2020-12-23
Description: SourceCodester Library Management System 1.0 is affected by SQL Injection allowing an attacker to bypass the user authentication and impersonate any user on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/160606/Library-Management-System-1.0-SQL-Injection.html; https://www.sourcecodester.com/php/14545/online-library-management-system-phpmysqli-full-source-code-2020.html; http://packetstormsecurity.com/files/160606/Library-Management-System-1.0-SQL-Injection.html
CVE: CVE-2020-28074
Published: 2020-12-23
Description: SourceCodester Online Health Care System 1.0 is affected by SQL Injection which allows a potential attacker to bypass the authentication system and become an admin.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/160599/Online-Health-Card-System-1.0-SQL-Injection.html; https://www.sourcecodester.com/php/14526/online-health-care-system-php-full-source-code-2020.html; http://packetstormsecurity.com/files/160599/Online-Health-Card-System-1.0-SQL-Injection.html
CVE: CVE-2020-35252
Published: 2020-12-23
Description: Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/49153; https://www.exploit-db.com/exploits/49153
CVE: CVE-2020-35269
Published: 2020-12-23
Description: Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://gist.github.com/MoSalah20/d1d40b43eafba0bd22ee4cddecad3cbc; https://gist.github.com/MoSalah20/d1d40b43eafba0bd22ee4cddecad3cbc
CVE: CVE-2020-35370
Published: 2020-12-23
Description: A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code execution(RCE) on the hosting server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.exploit-db.com/exploits/49265; https://www.exploit-db.com/exploits/49265
CVE: CVE-2020-35598
Published: 2020-12-23
Description: ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advanced_component_system/index.php?ACS_path=..%2f URI. NOTE: this might be the same as CVE-2009-4623
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://seclists.org/fulldisclosure/2020/Dec/13; https://seclists.org/fulldisclosure/2020/Dec/13
CVE: CVE-2020-35665
Published: 2020-12-23
Description: An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/172880/TerraMaster-TOS-4.2.06-Remote-Code-Execution.html; https://www.exploit-db.com/exploits/49330; https://www.pentest.com.tr/exploits/TerraMaster-TOS-4-2-06-Unauthenticated-Remote-Code-Execution.html
CVE: CVE-2020-35666
Published: 2020-12-23
Description: Steedos Platform through 1.21.24 allows NoSQL injection because the /api/collection/findone implementation in server/packages/steedos_base.js mishandles req.body validation, as demonstrated by MongoDB operator attacks such as an X-User-Id[$ne]=1 value.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/steedos/steedos-platform/issues/1245; https://github.com/steedos/steedos-platform/issues/1245
CVE: CVE-2020-35668
Published: 2020-12-23
Description: RedisGraph 2.x through 2.2.11 has a NULL Pointer Dereference that leads to a server crash because it mishandles an unquoted string, such as an alias that has not yet been introduced.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/RedisGraph/RedisGraph/issues/1502; https://github.com/RedisGraph/RedisGraph/pull/1503; https://github.com/RedisGraph/RedisGraph/issues/1502
CVE: CVE-2020-2499
Published: 2020-12-24
Description: A hard-coded password vulnerability has been reported to affect earlier versions of QES. If exploited, this vulnerability could allow attackers to log in with a hard-coded password. QNAP has already fixed the issue in QES 2.1.1 Build 20200515 and later.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-259, CWE-522, CWE-798, CWE-798
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-19; https://www.qnap.com/zh-tw/security-advisory/qsa-20-19
CVE: CVE-2020-2503
Published: 2020-12-24
Description: If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79, CWE-80, CWE-749, CWE-79
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-17; https://www.qnap.com/zh-tw/security-advisory/qsa-20-17
CVE: CVE-2020-2504
Published: 2020-12-24
Description: If exploited, this absolute path traversal vulnerability could allow attackers to traverse files in File Station. QNAP has already fixed these issues in QES 2.1.1 Build 20201006 and later.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-22, CWE-73, CWE-284, CWE-22
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-17; https://www.qnap.com/zh-tw/security-advisory/qsa-20-17