deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4776
Published: 2020-10-12
Description: A path traversal vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted file path in URL request to view arbitrary files on the system. IBM X-Force ID: 189154.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189154; https://www.ibm.com/support/pages/node/6346573; https://exchange.xforce.ibmcloud.com/vulnerabilities/189154
CVE: CVE-2020-4778
Published: 2020-10-12
Description: IBM Curam Social Program Management 7.0.9 and 7.0.10 uses MD5 algorithm for hashing token in a single instance which less safe than default SHA-256 cryptographic algorithm used throughout the CÃºram application. IBM X-Force ID: 189156.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189156; https://www.ibm.com/support/pages/node/6346575; https://exchange.xforce.ibmcloud.com/vulnerabilities/189156
CVE: CVE-2020-4779
Published: 2020-10-12
Description: A HTTP Verb Tampering vulnerability may impact IBM Curam Social Program Management 7.0.9 and 7.0.10. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass security access controls. IBM X-Force ID: 189156.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189157; https://www.ibm.com/support/pages/node/6346579; https://exchange.xforce.ibmcloud.com/vulnerabilities/189157
CVE: CVE-2020-4780
Published: 2020-10-12
Description: OOTB build scripts does not set the secure attribute on session cookie which may impact IBM Curam Social Program Management 7.0.9 and 7.0,10. The purpose of the 'secure' attribute is to prevent cookies from being observed by unauthorized parties. IBM X-Force ID: 189158.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189158; https://www.ibm.com/support/pages/node/6346581; https://exchange.xforce.ibmcloud.com/vulnerabilities/189158
CVE: CVE-2020-4781
Published: 2020-10-12
Description: An improper input validation before calling java readLine() method may impact IBM Curam Social Program Management 7.0.9 and 7.0.10, which could result in a denial of service. IBM X-Force ID: 189159.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189159; https://www.ibm.com/support/pages/node/6346585; https://exchange.xforce.ibmcloud.com/vulnerabilities/189159
CVE: CVE-2020-13341
Published: 2020-10-12
Description: An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-843
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13341.json; https://gitlab.com/gitlab-org/gitlab/-/issues/239348; https://hackerone.com/reports/960244
CVE: CVE-2020-13943
Published: 2020-10-12
Description: If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00021.html; https://lists.apache.org/thread.html/r4a390027eb27e4550142fac6c8317cc684b157ae314d31514747f307%40%3Cannounce.tomcat.apache.org%3E
CVE: CVE-2020-26867
Published: 2020-10-12
Description: ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/; https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03; https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
CVE: CVE-2020-26868
Published: 2020-10-12
Description: ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-767, CWE-668
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue/; https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03; https://www.pcvuesolutions.com/security
CVE: CVE-2020-26869
Published: 2020-10-12
Description: ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-017-session-information-exposure-in-arc-informatique-pcvue/; https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03; https://www.pcvuesolutions.com/security
CVE: CVE-2020-4302
Published: 2020-10-12
Description: IBM Cognos Analytics 11.0 and 11.1 could allow a remote attacker to execute arbitrary code on the system, caused by a CSV injection. By persuading a victim to open a specially-crafted excel file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 176610.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/176610; https://www.ibm.com/support/pages/node/6346922; https://exchange.xforce.ibmcloud.com/vulnerabilities/176610
CVE: CVE-2020-4388
Published: 2020-10-12
Description: IBM Cognos Analytics 11.0 and 11.1 could be vulnerable to a denial of service attack by failing to catch exceptions in a servlet also exposing debug information could also be used in future attacks. IBM X-Force ID: 179270.
CVSS Score: 8.2 (HIGH)
CWE: CWE-755
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179270; https://www.ibm.com/support/pages/node/6346922; https://exchange.xforce.ibmcloud.com/vulnerabilities/179270
CVE: CVE-2020-4678
Published: 2020-10-12
Description: IBM Security Guardium 11.2 could allow an attacker with admin access to obtain and read files that they normally would not have access to. IBM X-Force ID: 186423.
CVSS Score: 4.9 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186423; https://www.ibm.com/support/pages/node/6346884; https://exchange.xforce.ibmcloud.com/vulnerabilities/186423
CVE: CVE-2020-4679
Published: 2020-10-12
Description: IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186424.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186424; https://www.ibm.com/support/pages/node/6346884; https://exchange.xforce.ibmcloud.com/vulnerabilities/186424
CVE: CVE-2020-4680
Published: 2020-10-12
Description: IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186426.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186426; https://www.ibm.com/support/pages/node/6346884; https://exchange.xforce.ibmcloud.com/vulnerabilities/186426
CVE: CVE-2020-4681
Published: 2020-10-12
Description: IBM Security Guardium 11.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 186427.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186427; https://www.ibm.com/support/pages/node/6346884; https://exchange.xforce.ibmcloud.com/vulnerabilities/186427
CVE: CVE-2020-4689
Published: 2020-10-12
Description: IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-1236
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186696; https://www.ibm.com/support/pages/node/6346884; https://exchange.xforce.ibmcloud.com/vulnerabilities/186696
CVE: CVE-2020-4740
Published: 2020-10-12
Description: IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188150; https://www.ibm.com/support/pages/node/6346920; https://exchange.xforce.ibmcloud.com/vulnerabilities/188150
CVE: CVE-2020-4741
Published: 2020-10-12
Description: IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188197.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188197; https://www.ibm.com/support/pages/node/6346906; https://exchange.xforce.ibmcloud.com/vulnerabilities/188197
CVE: CVE-2020-7811
Published: 2020-10-12
Description: Samsung Update 3.0.2.0 ~ 3.0.32.0 has a vulnerability that allows privilege escalation as commands crafted by attacker are executed while the engine deserializes the data received during inter-process communication
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-502, CWE-502
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35708; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35708
CVE: CVE-2020-9087
Published: 2020-10-12
Description: Taurus-AL00A version 10.0.0.1(C00E1R1P1) has an out-of-bounds read vulnerability in XFRM module. An authenticated, local attacker may perform a specific operation to exploit this vulnerability. Due to insufficient validation of the parameters, which may be exploited to cause information leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-smartphone-en
CVE: CVE-2020-9090
Published: 2020-10-12
Description: FusionAccess version 6.5.1 has an improper authorization vulnerability. A command is authorized with incorrect privilege. Attackers with other privilege can execute the command to exploit this vulnerability. This may compromise normal service of the affected product.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-fa-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-fa-en
CVE: CVE-2020-9091
Published: 2020-10-12
Description: Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an out-of-bounds read and write vulnerability. Some functions do not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-03-smartphone-en
CVE: CVE-2020-9106
Published: 2020-10-12
Description: HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have a path traversal vulnerability. The system does not sufficiently validate certain pathname, successful exploit could allow the attacker access files and cause information disclosure.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-pathtraversal-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-pathtraversal-en
CVE: CVE-2020-9107
Published: 2020-10-12
Description: HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause the process reboot.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-readwriteoutbound-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-readwriteoutbound-en
CVE: CVE-2020-9108
Published: 2020-10-12
Description: HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) have an out-of-bounds read and write vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause the process reboot.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-outofbound-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-outofbound-en
CVE: CVE-2020-9109
Published: 2020-10-12
Description: There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-dos-en
CVE: CVE-2020-9122
Published: 2020-10-12
Description: Some Huawei products have an insufficient input verification vulnerability. Attackers can exploit this vulnerability in the LAN to cause service abnormal on affected devices.Affected product versions include:HiRouter-CD30-10 version 10.0.2.5;HiRouter-CT31-10 version 10.0.2.20;WS5200-12 version 10.0.1.9;WS5281-10 version 10.0.5.10;WS5800-10 version 10.0.3.25;WS7100-10 version 10.0.5.21;WS7200-10 version 10.0.5.21.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-verification-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-verification-en
CVE: CVE-2020-9123
Published: 2020-10-12
Description: HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8) and versions earlier than 10.1.0.160(C01E160R2P8) have a buffer overflow vulnerability. An attacker induces users to install malicious applications and sends specially constructed packets to affected devices after obtaining the root permission. Successful exploit may cause code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-buffer-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-buffer-en
CVE: CVE-2020-9230
Published: 2020-10-12
Description: WS5800-10 version 10.0.3.25 has a denial of service vulnerability. Due to improper verification of specific message, an attacker may exploit this vulnerability to cause specific function to become abnormal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-345
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-homerouter-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-homerouter-en
CVE: CVE-2020-9238
Published: 2020-10-12
Description: Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. A function in a module does not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-bufferoverflow-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-bufferoverflow-en
CVE: CVE-2020-9110
Published: 2020-10-12
Description: Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have an information disclosure vulnerability. The device does not sufficiently validate the output of device in certain specific scenario, the attacker can gain information in the victim's smartphone to launch the attack, successful exploit could cause information disclosure.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-informationleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-informationleak-en
CVE: CVE-2020-9240
Published: 2020-10-12
Description: Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a buffer overflow vulnerability. A function in a module does not verify inputs sufficiently. Attackers can exploit this vulnerability by sending specific request. This could compromise normal service of the affected device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-bufferoverflow-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-02-bufferoverflow-en
CVE: CVE-2020-12670
Published: 2020-10-12
Description: XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.webmin.com/security.html; https://www.webmin.com/security.html
CVE: CVE-2020-8820
Published: 2020-10-12
Description: An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.webmin.com/security.html; https://www.webmin.com/security.html
CVE: CVE-2020-8821
Published: 2020-10-12
Description: An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.webmin.com/security.html; https://www.webmin.com/security.html
CVE: CVE-2020-13903
Published: 2020-10-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-12254. Reason: This candidate is a reservation duplicate of CVE-2020-12254. Notes: All CVE users should reference CVE-2020-12254 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-25825
Published: 2020-10-12
Description: In Octopus Deploy 3.1.0 to 2020.4.0, certain scripts can reveal sensitive information to the user in the task logs.
CVSS Score: 7.5 (HIGH)
References: https://github.com/OctopusDeploy/Issues/issues/6604; https://github.com/OctopusDeploy/Issues/issues/6605; https://github.com/OctopusDeploy/Issues/issues/6606
CVE: CVE-2020-15250
Published: 2020-10-12
Description: In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like systems, the system's temporary directory is shared between all users on that system. Because of this, when files and directories are written into this directory they are, by default, readable by other users on that same system. This vulnerability does not allow other users to overwrite the contents of these directories or files. This is purely an information disclosure vulnerability. This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users. Because certain JDK file system APIs were only added in JDK 1.7, this this fix is dependent upon the version of the JDK you are using. For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1. For Java 1.6 and lower users: no patch is available, you must use the workaround below. If you are unable to patch, or are stuck running on Java 1.6, specifying the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability. For more information, including an example of vulnerable code, see the referenced GitHub Security Advisory.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-732
References: https://github.com/junit-team/junit4/blob/7852b90cfe1cea1e0cdaa19d490c83f0d8684b50/doc/ReleaseNotes4.13.1.md; https://github.com/junit-team/junit4/commit/610155b8c22138329f0723eec22521627dbc52ae; https://github.com/junit-team/junit4/issues/1676
CVE: CVE-2020-26546
Published: 2020-10-12
Description: An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://cds.thalesgroup.com/en/tcs-cert/CVE-2020-26546; https://excellium-services.com/cert-xlm-advisory/CVE-2020-26546/; https://excellium-services.com/cert-xlm-advisory/CVE-2020-26546/
CVE: CVE-2020-15012
Published: 2020-10-12
Description: A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can traverse up the file system to get access to content on disk (that the user running nxrm also has access to).
CVSS Score: 8.6 (HIGH)
CWE: CWE-22
References: https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]53; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]53