deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13345
Published: 2020-10-06
Description: An issue has been discovered in GitLab affecting all versions starting from 10.8. Reflected XSS on Multiple Routes
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13345.json; https://gitlab.com/gitlab-org/gitlab/-/issues/232829; https://hackerone.com/reports/946728
CVE: CVE-2020-15239
Published: 2020-10-06
Description: In xmpp-http-upload before version 0.4.0, when the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic. For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access. If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances. If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload. The issue is patched in version 0.4.0.
CVSS Score: 3.5 (LOW)
CWE: CWE-22
References: https://github.com/horazont/xmpp-http-upload/commit/[PII_REDACTED]1e89f0cd697c81f57714c00962ed75; https://github.com/horazont/xmpp-http-upload/pull/12; https://github.com/horazont/xmpp-http-upload/security/advisories/GHSA-hwv5-w8gm-fq9f
CVE: CVE-2020-15927
Published: 2020-10-06
Description: Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com; https://www.manageengine.com/products/applications_manager/issues.html#v14750; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-15927.html
CVE: CVE-2020-16267
Published: 2020-10-06
Description: Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA module.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com; https://www.manageengine.com/products/applications_manager/issues.html#v14750; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-16267.html
CVE: CVE-2020-26597
Published: 2020-10-06
Description: An issue was discovered on LG mobile devices with Android OS 9.0 and 10 software. The Wi-Fi subsystem has incorrect input validation, leading to a crash. The LG ID is LVE-SMP-200022 (October 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-26598
Published: 2020-10-06
Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, and 9.0 software. The Network Management component could allow an unauthorized actor to kill a TCP connection. The LG ID is LVE-SMP-200023 (October 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-26599
Published: 2020-10-06
Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. The DynamicLockscreen Terms and Conditions can be accepted without authentication. The Samsung ID is SVE-2020-17079 (October 2020).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26600
Published: 2020-10-06
Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. Auto Hotspot allows attackers to obtain sensitive information. The Samsung ID is SVE-2020-17288 (October 2020).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26601
Published: 2020-10-06
Description: An issue was discovered in DirEncryptService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingIntent with an empty intent is mishandled, allowing an attacker to perform a privileged action via a modified intent. The Samsung ID is SVE-2020-18034 (October 2020).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26602
Published: 2020-10-06
Description: An issue was discovered in EthernetNetwork on Samsung mobile devices with O(8.1), P(9.0), Q(10.0), and R(11.0) software. PendingIntent allows sdcard access by an unprivileged process. The Samsung ID is SVE-2020-18392 (October 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26603
Published: 2020-10-06
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. Sticker Center allows directory traversal for an unprivileged process to read arbitrary files. The Samsung ID is SVE-2020-18433 (October 2020).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26604
Published: 2020-10-06
Description: An issue was discovered in SystemUI on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. PendingIntent allows an unprivileged process to access contact numbers. The Samsung ID is SVE-2020-18467 (October 2020).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26605
Published: 2020-10-06
Description: An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attackers to obtain sensitive information by reading a log. The Samsung ID is SVE-2020-18596 (October 2020).
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26606
Published: 2020-10-06
Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) software. An attacker can access certain Secure Folder content via a debugging command. The Samsung ID is SVE-2020-18673 (October 2020).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-26607
Published: 2020-10-06
Description: An issue was discovered in TimaService on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. PendingIntent with an empty intent is mishandled, allowing an attacker to perform a privileged action via a modified intent. The Samsung ID is SVE-2020-18418 (October 2020).
CVSS Score: 9.8 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-14183
Published: 2020-10-06
Description: Affected versions of Jira Server & Data Center allow a remote attacker with limited (non-admin) privileges to view a Jira instance's Support Entitlement Number (SEN) via an Information Disclosure vulnerability in the HTTP Response headers. The affected versions are before version 7.13.18, from version 8.0.0 before 8.5.9, and from version 8.6.0 before 8.12.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://jira.atlassian.com/browse/JRASERVER-71646; https://jira.atlassian.com/browse/JRASERVER-71646
CVE: CVE-2020-7742
Published: 2020-10-07
Description: This affects the package simpl-schema before 1.10.2.
CVSS Score: 7.5 (HIGH)
References: https://github.com/aldeed/simpl-schema/blob/main/package/lib/utility/merge.js; https://snyk.io/vuln/SNYK-JS-SIMPLSCHEMA-1016157; https://github.com/aldeed/simpl-schema/blob/main/package/lib/utility/merge.js
CVE: CVE-2020-25985
Published: 2020-10-07
Description: MonoCMS Blog 1.0 is affected by: Arbitrary File Deletion. Any authenticated user can delete files on and off the webserver (php files can be unlinked and not deleted).
CVSS Score: 8.1 (HIGH)
CWE: CWE-22
References: https://monocms.com/download; https://www.exploit-db.com/exploits/48848; https://monocms.com/download
CVE: CVE-2020-13332
Published: 2020-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-13334
Published: 2020-10-07
Description: In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13334.json; https://gitlab.com/gitlab-org/gitlab/-/issues/195327; https://hackerone.com/reports/762271
CVE: CVE-2020-13335
Published: 2020-10-07
Description: Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13335.json; https://gitlab.com/gitlab-org/gitlab/-/issues/27231; https://hackerone.com/reports/503823
CVE: CVE-2020-13346
Published: 2020-10-07
Description: Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-459
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13346.json; https://gitlab.com/gitlab-org/gitlab/-/issues/219496; https://hackerone.com/reports/880863
CVE: CVE-2020-13347
Published: 2020-10-07
Description: A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13347.json; https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26725; https://hackerone.com/reports/955016
CVE: CVE-2020-25343
Published: 2020-10-07
Description: Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/48773; https://www.exploit-db.com/exploits/48773
CVE: CVE-2020-14355
Published: 2020-10-07
Description: Multiple buffer overflow vulnerabilities were found in the QUIC image decoding process of the SPICE remote display system, before spice-0.14.2-1. Both the SPICE client (spice-gtk) and server are affected by these flaws. These flaws allow a malicious client or server to send specially crafted messages that, when processed by the QUIC image compression algorithm, result in a process crash or potential code execution.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-120, CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00001.html; https://bugzilla.redhat.com/show_bug.cgi?id=1868435
CVE: CVE-2020-24722
Published: 2020-10-07
Description: An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause metadata deanonymization and risk-score inflation. NOTE: the vendor's position is "We do not believe that TX power authentication would be a useful defense against relay attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-294
References: http://packetstormsecurity.com/files/159496/GAEN-Protocol-Metadata-Deanonymization-Risk-Score-Inflation.html; http://seclists.org/fulldisclosure/2020/Oct/12; https://blog.google/inside-google/company-announcements/update-exposure-notifications
CVE: CVE-2019-16160
Published: 2020-10-07
Description: An integer underflow in the SMB server of MikroTik RouterOS before 6.45.5 allows remote unauthenticated attackers to crash the service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://forum.mikrotik.com/viewtopic.php?t=151603; https://gist.github.com/thebabush/3c71fc5001f8865e3ad579e80680ce24; https://mikrotik.com
CVE: CVE-2020-11800
Published: 2020-10-07
Description: Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00007.html; https://lists.debian.org/debian-lts-announce/2020/11/msg00039.html; https://support.zabbix.com/browse/DEV-1538
CVE: CVE-2020-13342
Published: 2020-10-07
Description: An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email
CVSS Score: 2.7 (LOW)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13342.json; https://gitlab.com/gitlab-org/gitlab/-/issues/222966; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13342.json
CVE: CVE-2020-24246
Published: 2020-10-07
Description: Peplink Balance before 8.1.0rc1 allows an unauthenticated attacker to download PHP configuration files (/filemanager/php/connector.php) from Web Admin.
CVSS Score: 7.5 (HIGH)
References: https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/; https://download.peplink.com/resources/firmware-8.1.0rc1-release-notes.pdf; https://blog.bssi.fr/cve-2020-24246-leaking-source-file-using-the-web-admin-interface-of-peplink-balance/
CVE: CVE-2020-26596
Published: 2020-10-07
Description: The Dynamic OOO widget for the Elementor Pro plugin through 3.0.5 for WordPress allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet. NOTE: this issue can be mitigated by removing the Dynamic OOO widget or by restricting availability of the Editor role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://elementor.com/pro/changelog/; https://ww2.compunet.cl/dia-cero-en-plugin-de-wordpres-detectada-compunet-redteam/; https://elementor.com/pro/changelog/
CVE: CVE-2020-26870
Published: 2020-10-07
Description: Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/cure53/DOMPurify/commit/02724b8eb048dd219d6725b05c3000936f11d62d; https://github.com/cure53/DOMPurify/compare/2.0.16...2.0.17; https://lists.debian.org/debian-lts-announce/2020/10/msg00029.html
CVE: CVE-2020-17551
Published: 2020-10-07
Description: ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ImpressCMS/impresscms/issues/659; https://www.impresscms.org/; https://github.com/ImpressCMS/impresscms/issues/659
CVE: CVE-2020-26876
Published: 2020-10-07
Description: The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and /wp-json/wp/v2/lesson exist).
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://plugins.trac.wordpress.org/changeset/2388997; https://plugins.trac.wordpress.org/changeset/2389243; https://www.redtimmy.com/critical-information-disclosure-on-wp-courses-plugin-exposes-private-course-videos-and-materials/
CVE: CVE-2020-26880
Published: 2020-10-07
Description: Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympa_newaliases-wrapper executable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://github.com/sympa-community/sympa/issues/1009; https://github.com/sympa-community/sympa/issues/943#issuecomment-704779420; https://github.com/sympa-community/sympa/issues/943#issuecomment-704842235
CVE: CVE-2020-15175
Published: 2020-10-07
Description: In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the files and folders contained in “/files/”. Some of the sensitive information that is compromised are the user sessions, logs, and more. An attacker would be able to get the Administrators session token and use that to authenticate. The issue is patched in version 9.5.2.
CVSS Score: 7.4 (HIGH)
CWE: CWE-552, CWE-552
References: https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65; https://github.com/glpi-project/glpi/security/advisories/GHSA-rm52-jx9h-rwcp; https://github.com/glpi-project/glpi/commit/6ca9a0e77299a755c356d758344a23278df67f65
CVE: CVE-2020-15176
Published: 2020-10-07
Description: In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive information like passwords, reset tokens, personal details, and more. The issue is patched in version 9.5.2
CVSS Score: 8.7 (HIGH)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575; https://github.com/glpi-project/glpi/security/advisories/GHSA-x93w-64x9-58qw; https://github.com/glpi-project/glpi/commit/f021f1f365b4acea5066d3e57c6d22658cf32575
CVE: CVE-2020-15177
Published: 2020-10-07
Description: In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication is not required to perform these changes,anyone could point these fields at malicious websites or form input in a way to trigger XSS. Leveraging JavaScript it's possible to steal cookies, perform actions as the user, etc. The issue is patched in version 9.5.2.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/commit/a8109d4ee970a222faf48cf48fae2d2f06465796; https://github.com/glpi-project/glpi/security/advisories/GHSA-prvh-9m4h-4m79; https://github.com/glpi-project/glpi/commit/a8109d4ee970a222faf48cf48fae2d2f06465796
CVE: CVE-2020-15217
Published: 2020-10-07
Description: In GLPI before version 9.5.2, there is a leakage of user information through the public FAQ. The issue was introduced in version 9.5.0 and patched in 9.5.2. As a workaround, disable public access to the FAQ.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/commit/39e25591efddc560e3679ab07e443ee6198705e2; https://github.com/glpi-project/glpi/security/advisories/GHSA-x9hg-j29f-wvvv; https://github.com/glpi-project/glpi/commit/39e25591efddc560e3679ab07e443ee6198705e2
CVE: CVE-2020-26164
Published: 2020-10-07
Description: In kdeconnect-kde (aka KDE Connect) before 20.08.2, an attacker on the local network could send crafted packets that trigger use of large amounts of CPU, memory, or network connection slots, aka a Denial of Service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00018.html; http://www.openwall.com/lists/oss-security/2020/10/13/4
CVE: CVE-2020-7316
Published: 2020-10-07
Description: Unquoted service path vulnerability in McAfee File and Removable Media Protection (FRP) prior to 5.3.0 allows local users to execute arbitrary code, with higher privileges, via execution and from a compromised folder. This issue may result in files not being encrypted when a policy is triggered.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10330; https://kc.mcafee.com/corporate/index?page=content&id=SB10330
CVE: CVE-2020-15226
Published: 2020-10-07
Description: In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it is also possible to utilise a UNION SELECT query to reflect sensitive information such as the current database version, or database user. The most likely scenario for this vulnerability is with someone who has an API account to the system. The issue is patched in version 9.5.2. A proof-of-concept with technical details is available in the linked advisory.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89
References: https://github.com/glpi-project/glpi/commit/3dc4475c56b241ad659cc5c7cb5fb65727409cf0; https://github.com/glpi-project/glpi/security/advisories/GHSA-jwpv-7m4h-5gvc; https://github.com/glpi-project/glpi/commit/3dc4475c56b241ad659cc5c7cb5fb65727409cf0
CVE: CVE-2020-25768
Published: 2020-10-07
Description: Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-74
References: https://community.contao.org/en/forumdisplay.php?4-Announcements; https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html; https://community.contao.org/en/forumdisplay.php?4-Announcements
CVE: CVE-2020-25867
Published: 2020-10-07
Description: SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/thomasfady/CVE-2020-25867; https://github.com/thomasfady/CVE-2020-25867
CVE: CVE-2015-7379
Published: 2020-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2015-7380
Published: 2020-10-07
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-15501
Published: 2020-10-07
Description: Smarter Coffee Maker before 2nd generation allows firmware replacement without authentication or authorization. User interaction is required to press a button. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 6.5 (MEDIUM)
References: https://decoded.avast.io/martinhron/the-fresh-smell-of-ransomed-coffee/; https://decoded.avast.io/martinhron/the-fresh-smell-of-ransomed-coffee/