deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28332
Published: 2020-11-24
Description: Barco wePresent WiPG-1600W devices download code without an Integrity Check. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W firmware does not perform verification of digitally signed firmware updates and is susceptible to processing and installing modified/malicious images.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-494
References: http://packetstormsecurity.com/files/160164/Barco-wePresent-Insecure-Firmware-Image.html; https://korelogic.com/Resources/Advisories/KL-001-2020-009.txt; http://packetstormsecurity.com/files/160164/Barco-wePresent-Insecure-Firmware-Image.html
CVE: CVE-2020-28333
Published: 2020-11-24
Description: Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Version(s): 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a "SEID" token that is appended to the end of URLs in GET requests. Thus the "SEID" would be exposed in web proxy logs and browser history. An attacker that is able to capture the "SEID" and originate requests from the same IP address (via a NAT device or web proxy) would be able to access the user interface of the device without having to know the credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200, CWE-287
References: http://packetstormsecurity.com/files/160161/Barco-wePresent-Authentication-Bypass.html; https://korelogic.com/Resources/Advisories/KL-001-2020-006.txt; http://packetstormsecurity.com/files/160161/Barco-wePresent-Authentication-Bypass.html
CVE: CVE-2020-28334
Published: 2020-11-24
Description: Barco wePresent WiPG-1600W devices use Hard-coded Credentials (issue 2 of 2). Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19. The Barco wePresent WiPG-1600W device has a hardcoded root password hash included in the firmware image. Exploiting CVE-2020-28329, CVE-2020-28330 and CVE-2020-28331 could potentially be used in a simple and automated exploit chain to go from unauthenticated remote attacker to root shell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/160163/Barco-wePresent-Global-Hardcoded-Root-SSH-Password.html; https://korelogic.com/Resources/Advisories/KL-001-2020-008.txt; http://packetstormsecurity.com/files/160163/Barco-wePresent-Global-Hardcoded-Root-SSH-Password.html
CVE: CVE-2020-25159
Published: 2020-11-24
Description: 499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-324-03; https://us-cert.cisa.gov/ics/advisories/icsa-20-324-03
CVE: CVE-2020-25654
Published: 2020-11-24
Description: An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1888191; https://lists.clusterlabs.org/pipermail/users/2020-October/027840.html; https://lists.debian.org/debian-lts-announce/2021/01/msg00007.html
CVE: CVE-2020-28329
Published: 2020-11-24
Description: Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://korelogic.com/Resources/Advisories/KL-001-2020-004.txt; https://korelogic.com/Resources/Advisories/KL-001-2020-004.txt
CVE: CVE-2020-29053
Published: 2020-11-24
Description: HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://grimthereaperteam.medium.com/hrsale-v-2-0-0-reflected-cross-site-scripting-17a5617e2c6e; https://hrsale.com/update_log.php; https://grimthereaperteam.medium.com/hrsale-v-2-0-0-reflected-cross-site-scripting-17a5617e2c6e
CVE: CVE-2015-9550
Published: 2020-11-24
Description: An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20[PII_REDACTED] and F1-V2 through 1.1-B20[PII_REDACTED] devices. By sending a specific hel,xasf packet to the WAN interface, it is possible to open the web management interface on the WAN interface.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html; https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html
CVE: CVE-2015-9551
Published: 2020-11-24
Description: An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20[PII_REDACTED] and F1-V2 through 1.1-B20[PII_REDACTED] devices. There is Remote Code Execution in the management interface via the formSysCmd sysCmd parameter.
CVSS Score: 9.8 (CRITICAL)
References: https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html; https://pierrekim.github.io/blog/2015-07-16-backdoor-and-RCE-found-in-8-TOTOLINK-products.html
CVE: CVE-2020-26232
Published: 2020-11-24
Description: Jupyter Server before version 1.0.6 has an Open redirect vulnerability. A maliciously crafted link to a jupyter server could redirect the browser to a different website. All jupyter servers are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may appear safe, but ultimately redirect to a spoofed server on the public internet.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/jupyter-server/jupyter_server/blob/master/CHANGELOG.md#106---2020-11-18; https://github.com/jupyter-server/jupyter_server/commit/3d83e49090289c431da253e2bdb8dc479cbcb157; https://github.com/jupyter/jupyter_server/security/advisories/GHSA-grfj-wjv9-4f9v
CVE: CVE-2020-29054
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. Attackers can use "show system infor" to discover cleartext TELNET credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29055
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. By default, the appliance can be managed remotely only with HTTP, telnet, and SNMP. It doesn't support SSL/TLS for HTTP or SSH. An attacker can intercept passwords sent in cleartext and conduct man-in-the-middle attacks on the management of the appliance.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29056
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. One can escape from a shell and acquire root privileges by leveraging the TFTP download configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29057
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. It allows remote attackers to cause a denial of service (reboot) by sending random bytes to the telnet server on port 23, aka a "shawarma" attack.
CVSS Score: 7.5 (HIGH)
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29058
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. Attackers can discover cleartext web-server credentials via certain /opt/lighttpd/web/cgi/ requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29059
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default panger123 password for the suma123 account for certain old firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29060
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default debug124 password for the debug account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29061
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default root126 password for the root account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29062
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. There is a default blank password for the guest account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-29063
Published: 2020-11-24
Description: An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, and FD8000 devices. A custom encryption algorithm is used to store encrypted passwords. This algorithm will XOR the password with the hardcoded *j7a(L#yZ98sSd5HfSgGjMj8;Ss;d)(*&^#@$a2s0i3g value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html; https://pierrekim.github.io/blog/2020-07-07-cdata-olt-0day-vulnerabilities.html
CVE: CVE-2020-26235
Published: 2020-11-24
Description: In Rust time crate from version 0.2.7 and before version 0.2.23, unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires the user to set any environment variable in a different thread than the affected functions. The affected functions are time::UtcOffset::local_offset_at, time::UtcOffset::try_local_offset_at, time::UtcOffset::current_local_offset, time::UtcOffset::try_current_local_offset, time::OffsetDateTime::now_local and time::OffsetDateTime::try_now_local. Non-Unix targets are unaffected. This includes Windows and wasm. The issue was introduced in version 0.2.7 and fixed in version 0.2.23.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://crates.io/crates/time/0.2.23; https://github.com/time-rs/time/issues/293; https://github.com/time-rs/time/security/advisories/GHSA-wcg3-cvx6-7396
CVE: CVE-2020-26237
Published: 2020-11-24
Description: Highlight.js is a syntax highlighter written in JavaScript. Highlight.js versions before 9.18.2 and 10.1.2 are vulnerable to Prototype Pollution. A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting. If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. If your website or application does not render user provided data it should be unaffected. Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability. If you are using version 7 or 8 you are encouraged to upgrade to a newer release.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-471
References: https://github.com/highlightjs/highlight.js/commit/7241013ae011a585983e176ddc0489a7a52f6bb0; https://github.com/highlightjs/highlight.js/pull/2636; https://github.com/highlightjs/highlight.js/security/advisories/GHSA-vfrc-7r7c-w9mx
CVE: CVE-2020-26238
Published: 2020-11-25
Description: Cron-utils is a Java library to parse, validate, migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3, a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.
CVSS Score: 7.9 (HIGH)
CWE: CWE-74
References: https://github.com/jmrozanec/cron-utils/commit/4cf373f7352f5d95f0bf6512af8af326b31c835e; https://github.com/jmrozanec/cron-utils/issues/461; https://github.com/jmrozanec/cron-utils/security/advisories/GHSA-pfj3-56hm-jwq5
CVE: CVE-2020-29069
Published: 2020-11-25
Description: _get_flag_ip_localdb in server/mhn/ui/utils.py in Modern Honey Network (MHN) through 2020-11-23 allows attackers to cause a denial-of-service via an IP address that is absent from a local geolocation database, because the code tries to uppercase a return value even if that value is not a string.
CVSS Score: 5.5 (MEDIUM)
References: https://github.com/pwnlandia/mhn/issues/799; https://github.com/pwnlandia/mhn/issues/799
CVE: CVE-2020-26240
Published: 2020-11-25
Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-682, CWE-682
References: https://blog.ethereum.org/2020/11/12/geth_security_release/; https://github.com/ethereum/go-ethereum/commit/d990df909d[PII_REDACTED]344e[PII_REDACTED]4dcdd0; https://github.com/ethereum/go-ethereum/pull/21793
CVE: CVE-2020-26241
Published: 2020-11-25
Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-682
References: https://blog.ethereum.org/2020/11/12/geth_security_release/; https://github.com/ethereum/go-ethereum/security/advisories/GHSA-69v6-xc2j-r2jf; https://blog.ethereum.org/2020/11/12/geth_security_release/
CVE: CVE-2020-26242
Published: 2020-11-25
Description: Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. In Geth before version 1.9.18, there is a Denial-of-service (crash) during block processing. This is fixed in 1.9.18.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.ethereum.org/2020/11/12/geth_security_release/; https://github.com/ethereum/go-ethereum/security/advisories/GHSA-jm5c-rv3w-w83m; https://blog.ethereum.org/2020/11/12/geth_security_release/
CVE: CVE-2020-29071
Published: 2020-11-25
Description: An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments, when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails, depending on the permissions of the target user.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://lean0x2f.github.io/liquidfiles_advisory; https://man.liquidfiles.com/release_notes/version_3-3-x.html; https://lean0x2f.github.io/liquidfiles_advisory
CVE: CVE-2020-29072
Published: 2020-11-25
Description: A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-829
References: https://lean0x2f.github.io/liquidfiles_advisory; https://man.liquidfiles.com/release_notes/version_3-3-x.html; https://lean0x2f.github.io/liquidfiles_advisory
CVE: CVE-2020-25650
Published: 2020-11-25
Description: A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest user with access to the UNIX domain socket path `/run/spice-vdagentd/spice-vdagent-sock` could use this flaw to perform a memory denial of service for spice-vdagentd or even other processes in the VM system. The highest threat from this vulnerability is to system availability. This flaw affects spice-vdagent versions 0.20 and previous versions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770, CWE-770
References: https://bugzilla.redhat.com/show_bug.cgi?id=1886345; https://lists.debian.org/debian-lts-announce/2021/01/msg00012.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GQT56LATVTB2DJOVVJOKQVMVUXYCT2VB/
CVE: CVE-2020-26212
Published: 2020-11-25
Description: GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of every other user, even admin ones. Steps to reproduce the behavior: 1. Create a new planning with 'eduardo.mozart' user (from 'IT' group that belongs to 'Super-admin') into it's personal planning at 'Assistance' > 'Planning'. 2. Copy the CalDAV url and use a CalDAV client (e.g. Thunderbird) to sync the planning with the provided URL. 3. Inform the username and password from any valid user (e.g. 'camila' from 'Proativa' group). 4. 'Camila' has read-only access to 'eduardo.mozart' personal planning. The same behavior happens to any group. E.g. 'Camila' has access to 'IT' group planning, even if she doesn't belong to this group and has a 'Self-service' profile permission). This issue is fixed in version 9.5.3. As a workaround, one can remove the `caldav.php` file to block access to CalDAV server.
CVSS Score: 7.7 (HIGH)
CWE: CWE-862
References: https://github.com/glpi-project/glpi/commit/527280358ec78988ac57e9809d2eb21fcd74caf7; https://github.com/glpi-project/glpi/releases/tag/9.5.3; https://github.com/glpi-project/glpi/security/advisories/GHSA-qmw3-87hr-5wgx
CVE: CVE-2020-26243
Published: 2020-11-25
Description: Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: https://github.com/nanopb/nanopb/blob/2b48a361786dfb1f63d229840217a93aae064667/CHANGELOG.txt; https://github.com/nanopb/nanopb/commit/4fe23595732b6f1254cfc11a9b8d6da900b55b0c; https://github.com/nanopb/nanopb/issues/615
CVE: CVE-2020-29070
Published: 2020-11-25
Description: osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://forums.oscommerce.com/forum/17-news-and-announcements/; https://github.com/aslanemre/cve-2020-29070/blob/main/CVE-2020-29070; https://github.com/gburton/CE-Phoenix/commits/master
CVE: CVE-2020-14191
Published: 2020-11-25
Description: Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
CVSS Score: 7.5 (HIGH)
References: https://jira.atlassian.com/browse/CRUC-8501; https://jira.atlassian.com/browse/FE-7332; https://jira.atlassian.com/browse/CRUC-8501