deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5735
Published: 2020-06-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2019. Notes: none
CVE: CVE-2020-0113
Published: 2020-06-10
Description: In sendCaptureResult of Camera3OutputUtils.cpp, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-9Android ID: A-150944913
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-416
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-0114
Published: 2020-06-10
Description: In onCreateSliceProvider of KeyguardSliceProvider.java, there is a possible confused deputy due to a PendingIntent error. This could lead to local escalation of privilege that allows actions performed as the System UI, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-147606347
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-0115
Published: 2020-06-10
Description: In verifyIntentFiltersIfNeeded of PackageManagerService.java, there is a possible settings bypass allowing an app to become the default handler for arbitrary domains. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-8.0Android ID: A-150038428
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-0116
Published: 2020-06-10
Description: In checkSystemLocationAccess of LocationAccessPolicy.java, there is a possible bypass of user profile isolation due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-151330809
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-0117
Published: 2020-06-10
Description: In aes_cmac of aes_cmac.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution in the bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-8.0Android ID: A-151155194
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-0118
Published: 2020-06-10
Description: In addListener of RegionSamplingThread.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150904694
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-0119
Published: 2020-06-10
Description: In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150500247
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-0121
Published: 2020-06-10
Description: In updateUidProcState of AppOpsService.java, there is a possible permission bypass due to a logic error. This could lead to local information disclosure of location data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-148180766
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-06-01; https://source.android.com/security/bulletin/2020-06-01
CVE: CVE-2020-11798
Published: 2020-06-10
Description: A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/171751/Mitel-MiCollab-AWV-8.1.2.4-9.1.3-Directory-Traversal-LFI.html; https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin-20-0005-01.pdf; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005
CVE: CVE-2020-14010
Published: 2020-06-10
Description: The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://knassar702.github.io/cve/xenon/; https://knassar702.github.io/cve/xenon/
CVE: CVE-2020-14012
Published: 2020-06-10
Description: scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/osTicket/osTicket/issues/5514; https://github.com/osTicket/osTicket/issues/5514
CVE: CVE-2020-2023
Published: 2020-06-10
Description: Kata Containers doesn't restrict containers from accessing the guest's root filesystem device. Malicious containers can exploit this to gain code execution on the guest and masquerade as the kata-agent. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; and Kata Containers 1.9 and earlier versions.
CVSS Score: 3.8 (LOW)
CWE: CWE-250
References: https://github.com/kata-containers/agent/issues/791; https://github.com/kata-containers/agent/pull/792; https://github.com/kata-containers/runtime/issues/2488
CVE: CVE-2020-2026
Published: 2020-06-10
Description: A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://github.com/kata-containers/runtime/issues/2712; https://github.com/kata-containers/runtime/pull/2713; https://github.com/kata-containers/runtime/releases/tag/1.10.5
CVE: CVE-2020-2027
Published: 2020-06-10
Description: A buffer overflow vulnerability in the authd component of the PAN-OS management server allows authenticated administrators to disrupt system processes and potentially execute arbitrary code with root privileges. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://security.paloaltonetworks.com/CVE-2020-2027; https://security.paloaltonetworks.com/CVE-2020-2027
CVE: CVE-2020-2028
Published: 2020-06-10
Description: An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/CVE-2020-2028; https://security.paloaltonetworks.com/CVE-2020-2028
CVE: CVE-2020-2029
Published: 2020-06-10
Description: An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions of PAN-OS 8.0; PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/CVE-2020-2029; https://security.paloaltonetworks.com/CVE-2020-2029
CVE: CVE-2020-2032
Published: 2020-06-10
Description: A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges. This issue can be exploited only while performing a GlobalProtect app upgrade. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 on Windows; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 on Windows.
CVSS Score: 7.0 (HIGH)
CWE: CWE-367, CWE-367
References: https://security.paloaltonetworks.com/CVE-2020-2032; https://security.paloaltonetworks.com/CVE-2020-2032
CVE: CVE-2020-2033
Published: 2020-06-10
Description: When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or to conduct ARP spoofing attacks. This allows the attacker to access the GlobalProtect Server as allowed by configured Security rules for the 'pre-login' user. This access may be limited compared to the network access of regular users. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 when the prelogon feature is enabled; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 when the prelogon feature is enabled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-295, CWE-290, CWE-295
References: https://security.paloaltonetworks.com/CVE-2020-2033; https://security.paloaltonetworks.com/CVE-2020-2033
CVE: CVE-2020-12757
Published: 2020-06-10
Description: HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020; https://www.hashicorp.com/blog/category/vault/; https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
CVE: CVE-2020-13223
Published: 2020-06-10
Description: HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020; https://www.hashicorp.com/blog/category/vault/; https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
CVE: CVE-2020-13444
Published: 2020-06-10
Description: Liferay Portal 7.x before 7.3.2, and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 5 does not sanitize the information returned by the DDMDataProvider API, which allows remote authenticated users to obtain the password to REST Data Providers.
CVSS Score: 6.5 (MEDIUM)
References: https://issues.liferay.com/browse/LPE-17009; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317396; https://issues.liferay.com/browse/LPE-17009
CVE: CVE-2020-13445
Published: 2020-06-10
Description: In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92, 7.1 before fix pack 18, and 7.2 before fix pack 6, the template API does not restrict user access to sensitive objects, which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74, CWE-862
References: https://issues.liferay.com/browse/LPE-17023; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317411; https://securitylab.github.com/advisories/GHSL-2020-043-liferay_ce
CVE: CVE-2020-13905
Published: 2020-06-10
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]038ed4.
CVSS Score: 8.8 (HIGH)
References: https://github.com/nhiephon/Research/blob/master/README.md; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research/blob/master/README.md
CVE: CVE-2020-13906
Published: 2020-06-10
Description: IrfanView 4.54 allows a user-mode write access violation starting at FORMATS!GetPlugInInfo+0x[PII_REDACTED]038eb7.
CVSS Score: 7.8 (HIGH)
References: https://github.com/nhiephon/Research/blob/master/README.md; https://www.irfanview.com/plugins.htm; https://github.com/nhiephon/Research/blob/master/README.md
CVE: CVE-2020-10705
Published: 2020-06-10
Description: A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://bugzilla.redhat.com/show_bug.cgi?id=1803241; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=1803241
CVE: CVE-2020-11622
Published: 2020-06-10
Description: A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368.*, 4.21.4-FCRFX.*, 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1 Router code in a scenario where TCP MSS options are configured.
CVSS Score: 7.5 (HIGH)
References: https://www.arista.com/en/support/advisories-notices; https://www.arista.com/en/support/advisories-notices/security-advisories/11195-security-advisory-49; https://www.arista.com/en/support/advisories-notices
CVE: CVE-2020-13238
Published: 2020-06-10
Description: Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://jvn.jp/vu/JVNVU97662844/index.html; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdf; https://www.us-cert.gov/ics/advisories/icsa-20-161-02
CVE: CVE-2020-4043
Published: 2020-06-10
Description: phpMussel from versions 1.0.0 and less than 1.6.0 has an unserialization vulnerability in PHP's phar wrapper. Uploading a specially crafted file to an affected version allows arbitrary code execution (discovered, tested, and confirmed by myself), so the risk factor should be regarded as very high. Newer phpMussel versions don't use PHP's phar wrapper, and are therefore unaffected. This has been fixed in version 1.6.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-502
References: https://github.com/phpMussel/phpMussel/commit/97f[PII_REDACTED]1c1f953430f32d3081adc4851a4; https://github.com/phpMussel/phpMussel/issues/167; https://github.com/phpMussel/phpMussel/pull/173
CVE: CVE-2020-5362
Published: 2020-06-10
Description: Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell Manageability interface for which an unauthorized actor, with local system access with OS administrator privileges, could bypass the BIOS Administrator authentication to restore BIOS Setup configuration to default values.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285, CWE-862
References: https://www.dell.com/support/article/SLN321726; https://www.dell.com/support/article/SLN321726
CVE: CVE-2020-5363
Published: 2020-06-10
Description: Select Dell Client Consumer and Commercial platforms include an issue that allows the BIOS Admin password to be changed through Dell's manageability interface without knowledge of the current BIOS Admin password. This could potentially allow an unauthorized actor, with physical access and/or OS administrator privileges to the device, to gain privileged access to the platform and the hard drive.
CVSS Score: 8.6 (HIGH)
CWE: CWE-158
References: https://www.dell.com/support/article/SLN321604; https://www.dell.com/support/article/SLN321604
CVE: CVE-2020-13898
Published: 2020-06-10
Description: An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_process in sdp.c has a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L120; https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L123; https://github.com/meetecho/janus-gateway/pull/2214
CVE: CVE-2020-13899
Published: 2020-06-10
Description: An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_process_incoming_request in janus.c discloses information from uninitialized stack memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://github.com/meetecho/janus-gateway/blob/v0.10.0/janus.c#L1326; https://github.com/meetecho/janus-gateway/pull/2214; https://github.com/merrychap/poc_exploits/tree/master/janus-webrtc/CVE-2020-13899
CVE: CVE-2020-13900
Published: 2020-06-10
Description: An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_preparse in sdp.c has a NULL pointer dereference.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L64; https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L74; https://github.com/meetecho/janus-gateway/pull/2214
CVE: CVE-2020-13901
Published: 2020-06-10
Description: An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack-based buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/meetecho/janus-gateway/blob/v0.10.0/sdp.c#L1248; https://github.com/meetecho/janus-gateway/pull/2214; https://github.com/merrychap/poc_exploits/tree/master/janus-webrtc/CVE-2020-13901
CVE: CVE-2020-11090
Published: 2020-06-11
Description: In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/hyperledger/indy-node/blob/master/CHANGELOG.md#1123; https://github.com/hyperledger/indy-node/security/advisories/GHSA-3gw4-m5w7-v89c; https://pypi.org/project/indy-node/1.12.3/
CVE: CVE-2020-12713
Published: 2020-06-11
Description: An issue was discovered in CipherMail Community Gateway and Professional/Enterprise Gateway 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger 1.1.1 through 3.1.1-0. Attackers with administrative access to the web interface have multiple options to escalate their privileges to the Unix root account.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/158001/CipherMail-Community-Virtual-Appliance-4.6.2-Code-Execution.html; https://www.ciphermail.com/blog/ciphermail-cve-2020-12713_2020-12714.html; https://www.ciphermail.com/gateway.html
CVE: CVE-2020-12714
Published: 2020-06-11
Description: An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman parameter of insufficient size could allow man-in-the-middle compromise of communications between CipherMail products and external SMTP clients.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: https://packetstormsecurity.com/files/158001/CipherMail-Community-Virtual-Appliance-4.6.2-Code-Execution.html; https://www.ciphermail.com/blog/ciphermail-cve-2020-12713_2020-12714.html; https://www.ciphermail.com/gateway.html
CVE: CVE-2020-12850
Published: 2020-06-11
Description: The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the appliance, the user pydio is responsible for running all the services and binaries that are contained in the Pydio Cells web application package, such as mysqld, cells, among others. This user has privileges restricted to run those services and nothing more.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html; https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities
CVE: CVE-2020-13998
Published: 2020-06-11
Description: Citrix XenApp 6.5, when 2FA is enabled, allows a remote unauthenticated attacker to ascertain whether a user exists on the server, because the 2FA error page only occurs after a valid username is entered. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203, CWE-639
References: https://gist.github.com/kampji/11e259d68ad98a6f0f898132f1961a96; https://gist.github.com/kampji/11e259d68ad98a6f0f898132f1961a96
CVE: CVE-2020-13850
Published: 2020-06-11
Description: Artica Pandora FMS 7.44 has inadequate access controls on a web folder.
CVSS Score: 7.5 (HIGH)
CWE: CWE-425
References: https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities; https://www.coresecurity.com/advisories
CVE: CVE-2020-13851
Published: 2020-06-11
Description: Artica Pandora FMS 7.44 allows remote command execution via the events feature.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/158390/Pandora-FMS-7.0-NG-7XX-Remote-Command-Execution.html; https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities
CVE: CVE-2020-13852
Published: 2020-06-11
Description: Artica Pandora FMS 7.44 allows arbitrary file upload (leading to remote command execution) via the File Manager feature.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities; https://www.coresecurity.com/advisories
CVE: CVE-2020-13853
Published: 2020-06-11
Description: Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.coresecurity.com/advisories; https://www.coresecurity.com/core-labs/advisories/pandora-fms-community-multiple-vulnerabilities; https://www.coresecurity.com/advisories