deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15794
Published: 2020-04-24
Description: Overlayfs in the Linux kernel and shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, both replace vma->vm_file in their mmap handlers. On error the original value is not restored, and the reference is put for the file to which vm_file points. On upstream kernels this is not an issue, as no callers dereference vm_file following after call_mmap() returns an error. However, the aufs patchs change mmap_region() to replace the fput() using a local variable with vma_fput(), which will fput() vm_file, leading to a refcount underflow.
CVSS Score: 7.1 (HIGH)
CWE: CWE-672, CWE-672
References: https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=270d16ae48a4dbf1c7e25e94cc3e38b4bea37635; https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan/commit/?id=ef81780548d20a786cc77ed4203fca146fd81ce3; https://usn.ubuntu.com/usn/usn-4208-1
CVE: CVE-2020-12128
Published: 2020-04-24
Description: DONG JOO CHO File Transfer iFamily 2.1 allows directory traversal related to the ./etc/ path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.vulnerability-lab.com/get_content.php?id=2199; https://www.vulnerability-lab.com/get_content.php?id=2199
CVE: CVE-2020-12129
Published: 2020-04-24
Description: The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2203; https://www.vulnerability-lab.com/get_content.php?id=2203
CVE: CVE-2020-12130
Published: 2020-04-24
Description: The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2203; https://www.vulnerability-lab.com/get_content.php?id=2203
CVE: CVE-2020-12131
Published: 2020-04-24
Description: The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2203; https://www.vulnerability-lab.com/get_content.php?id=2203
CVE: CVE-2020-12132
Published: 2020-04-24
Description: Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.fifthplay.com/faq/; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5561.php; https://www.fifthplay.com/faq/
CVE: CVE-2020-12134
Published: 2020-04-24
Description: Nanometrics Centaur through 4.3.23 and TitanSMA through 4.2.20 mishandle access control for the syslog log.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-772
References: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5562.php; https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5562.php
CVE: CVE-2020-12135
Published: 2020-04-24
Description: bson before 0.8 incorrectly uses int rather than size_t for many variables, parameters, and return values. In particular, the bson_ensure_space() parameter bytesNeeded could have an integer overflow via properly constructed bson input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190
References: https://bugs.launchpad.net/ubuntu/+source/whoopsie/+bug/1872560; https://github.com/10gen-archive/mongo-c-driver-legacy/commit/1a1f5e26a4309480d88598913f9eebf9e9cba8ca#diff-f7d29a680148f52d6601f59ed787f577; https://launchpadlibrarian.net/474887364/bson-fix-overflow.patch
CVE: CVE-2020-12063
Published: 2020-04-24
Description: A certain Postfix 2.10.1-7 package could allow an attacker to send an email from an arbitrary-looking sender via a homoglyph attack, as demonstrated by the similarity of \xce\xbf to the 'o' character. This is potentially relevant when the /etc/postfix/sender_login feature is used, because a spoofed outbound message that uses a configured sender address is blocked with a "Sender address rejected: not logged in" error message, but a spoofed outbound message that uses a homoglyph of a configured sender address is not blocked. NOTE: some third parties argue that any missed blocking of spoofed outbound messages - except for exact matches to a sender address in the /etc/postfix/sender_login file - is outside the design goals of Postfix and thus cannot be considered a Postfix vulnerability
CVSS Score: 5.3 (MEDIUM)
References: https://www.openwall.com/lists/oss-security/2020/04/23/12; https://www.openwall.com/lists/oss-security/2020/04/23/3; https://www.openwall.com/lists/oss-security/2020/04/23/12
CVE: CVE-2017-18728
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051527/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2136; https://kb.netgear.com/000051527/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2136
CVE: CVE-2017-18729
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6020 before 1.0.0.30, R6080 before 1.0.0.30, R6120 before 1.0.0.36, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051526/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2135; https://kb.netgear.com/000051526/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2135
CVE: CVE-2017-18730
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6020 before 1.0.0.30, R6080 before 1.0.0.30, R6120 before 1.0.0.36, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051525/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2134; https://kb.netgear.com/000051525/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2134
CVE: CVE-2017-18731
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6100 before 1.0.1.16, R7500 before 1.0.0.112, R7500v2 before 1.0.3.20, R7800 before 1.0.2.36, and WNR2000v5 before 1.0.0.58.
CVSS Score: 8.8 (HIGH)
References: https://kb.netgear.com/000051524/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2016-0096; https://kb.netgear.com/000051524/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2016-0096
CVE: CVE-2020-12137
Published: 2020-04-24
Description: GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://bazaar.launchpad.net/~mailman-coders/mailman/2.1/view/head:/NEWS; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.html
CVE: CVE-2020-5868
Published: 2020-04-24
Description: In BIG-IQ 6.0.0-7.0.0, a remote access vulnerability has been discovered that may allow a remote user to execute shell commands on affected systems using HTTP requests to the BIG-IQ user interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://support.f5.com/csp/article/K37130415; https://support.f5.com/csp/article/K37130415
CVE: CVE-2017-18706
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6100 before 1.0.1.20, R7500 before 1.0.0.118, WNDR3700v4 before 1.0.2.88, WNDR4300 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, and WNR2000v5 before 1.0.0.62.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.netgear.com/000053196/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2017-0516; https://kb.netgear.com/000053196/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2017-0516
CVE: CVE-2017-18707
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects R8300 before 1.0.2.106 and R8500 before 1.0.2.106.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://kb.netgear.com/000053158/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2017-0316; https://kb.netgear.com/000053158/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2017-0316
CVE: CVE-2017-18708
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by CSRF. This affects R8300 before 1.0.2.94 and R8500 before 1.0.2.94.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000053157/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2017-0336; https://kb.netgear.com/000053157/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2017-0336
CVE: CVE-2017-18709
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R8300 before 1.0.2.94 and R8500 before 1.0.2.94.
CVSS Score: 7.8 (HIGH)
References: https://kb.netgear.com/000053156/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2017-0326; https://kb.netgear.com/000053156/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-PSV-2017-0326
CVE: CVE-2017-18710
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects R8300 before 1.0.2.106 and R8500 before 1.0.2.106.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://kb.netgear.com/000053155/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-PSV-2017-0309; https://kb.netgear.com/000053155/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-Routers-PSV-2017-0309
CVE: CVE-2017-18711
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.28, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 before 1.0.1.34, R6900P before 1.3.0.8, R7000 before 1.0.9.14, R7000P before 1.3.0.8, R7500v2 before 1.0.3.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR4300v2 before 1.0.0.48, and WNDR4500v3 before 1.0.0.48.
CVSS Score: 8.8 (HIGH)
References: https://kb.netgear.com/000053137/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2016-0131; https://kb.netgear.com/000053137/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2016-0131
CVE: CVE-2017-18712
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D7800 before 1.0.1.28, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR4300v2 before 1.0.0.48, and WNDR4500v3 before 1.0.0.48.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://kb.netgear.com/000053136/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2016-0127; https://kb.netgear.com/000053136/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2016-0127
CVE: CVE-2017-18713
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D7800 before 1.0.1.28, R6700 before 1.0.1.36, R6900 before 1.0.1.34, R7500v2 before 1.0.3.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR4300v2 before 1.0.0.48, and WNDR4500v3 before 1.0.0.48.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://kb.netgear.com/000053135/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2016-0114; https://kb.netgear.com/000053135/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2016-0114
CVE: CVE-2017-18714
Published: 2020-04-24
Description: NETGEAR WNDR4500v3 devices before 1.0.0.48 are affected by denial of service.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.netgear.com/000053134/Security-Advisory-for-Denial-of-Service-on-WNDR4500v3-PSV-2016-0077; https://kb.netgear.com/000053134/Security-Advisory-for-Denial-of-Service-on-WNDR4500v3-PSV-2016-0077
CVE: CVE-2017-18715
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by reflected XSS. This affects EX3700 before 1.0.0.66, EX3800 before 1.0.0.66, EX6100 before 1.0.2.20, EX6120 before 1.0.0.34, EX6150 before 1.0.0.36, EX6200 before 1.0.3.84, and EX7000 before 1.0.0.60.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000053133/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Extenders-PSV-2016-0075; https://kb.netgear.com/000053133/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Extenders-PSV-2016-0075
CVE: CVE-2017-18716
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052281/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2156; https://kb.netgear.com/000052281/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2156
CVE: CVE-2017-18717
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052280/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2153; https://kb.netgear.com/000052280/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2153
CVE: CVE-2017-18718
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052279/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2152; https://kb.netgear.com/000052279/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2152
CVE: CVE-2017-18719
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6020 before 1.1.00.26, R6080 before 1.1.00.26; R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052278/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2150; https://kb.netgear.com/000052278/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2150
CVE: CVE-2017-18720
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-287
References: https://kb.netgear.com/000052277/Security-Advisory-for-Authentication-Bypass-on-Routers-PSV-2017-2148; https://kb.netgear.com/000052277/Security-Advisory-for-Authentication-Bypass-on-Routers-PSV-2017-2148
CVE: CVE-2017-18721
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052276/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2147; https://kb.netgear.com/000052276/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2147
CVE: CVE-2017-18722
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052275/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2146; https://kb.netgear.com/000052275/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2146
CVE: CVE-2017-18723
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052274/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2145; https://kb.netgear.com/000052274/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2145
CVE: CVE-2017-18724
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000052273/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2144; https://kb.netgear.com/000052273/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2144
CVE: CVE-2017-18725
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24. R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051530/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2141; https://kb.netgear.com/000051530/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-and-Gateways-PSV-2017-2141
CVE: CVE-2017-18726
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects R6020 before 1.0.0.30, R6080 before 1.0.0.30, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051529/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2139; https://kb.netgear.com/000051529/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2139
CVE: CVE-2017-18727
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://kb.netgear.com/000051528/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2138; https://kb.netgear.com/000051528/Security-Advisory-for-Pre-Authentication-Stack-Overflow-on-Routers-PSV-2017-2138
CVE: CVE-2020-5869
Published: 2020-04-24
Description: In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-924
References: https://support.f5.com/csp/article/K28855111; https://support.f5.com/csp/article/K28855111
CVE: CVE-2020-5870
Published: 2020-04-24
Description: In BIG-IQ 5.2.0-7.0.0, high availability (HA) synchronization mechanisms do not use any form of authentication for connecting to the peer.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://support.f5.com/csp/article/K69422435; https://support.f5.com/csp/article/K69422435
CVE: CVE-2017-18697
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40 and R9000 before 1.0.2.52.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000053205/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2628; https://kb.netgear.com/000053205/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2628
CVE: CVE-2017-18698
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6100 before 1.0.1.20, R7800 before 1.0.2.40, and R9000 before 1.0.2.52.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000053204/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2626; https://kb.netgear.com/000053204/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2626
CVE: CVE-2017-18699
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R7800 before 1.0.2.40 and R9000 before 1.0.2.52.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000053203/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2595; https://kb.netgear.com/000053203/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-PSV-2017-2595
CVE: CVE-2017-18700
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by stored XSS. This affects D6400 before 1.0.0.60, D7000 before 1.0.1.50, D8500 before 1.0.3.29, EX6200 before 1.0.3.84, EX7000 before 1.0.0.60, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 before 1.0.1.34, R6900P before 1.3.0.8, R7000 before 1.0.9.14, R7000P before 1.3.0.8, R7100LG before 1.0.0.34, R7300DST before 1.0.0.56, R7900 before 1.0.1.26, R8000 before 1.0.4.4, R8300 before 1.0.2.106, R8500 before 1.0.2.106, R9000 before 1.0.2.52, WNDR3400v3 before 1.0.1.16, WNR3500Lv2 before 1.2.0.46, and WNDR3700v5 before 1.1.0.48.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000053202/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0342; https://kb.netgear.com/000053202/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0342
CVE: CVE-2017-18701
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000053201/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Routers-PSV-2017-2513; https://kb.netgear.com/000053201/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Routers-PSV-2017-2513
CVE: CVE-2017-18702
Published: 2020-04-24
Description: NETGEAR R6220 devices before 1.1.0.60 are affected by incorrect configuration of security settings.
CVSS Score: 5.4 (MEDIUM)
References: https://kb.netgear.com/000053200/Security-Advisory-for-Security-Misconfiguration-on-R6220-PSV-2017-2211; https://kb.netgear.com/000053200/Security-Advisory-for-Security-Misconfiguration-on-R6220-PSV-2017-2211