deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-2271
Published: 2020-01-14
Description: cn.wps.moffice.common.beans.print.CloudPrintWebView in Kingsoft Office 5.3.1, as used in Huawei P2 devices before V100R001C00B043, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and execute arbitrary Java code by leveraging a network position between the client and the registry to block HTTPS traffic.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-401529.htm; http://www.securityfocus.com/bid/71381; https://exchange.xforce.ibmcloud.com/vulnerabilities/99089
CVE: CVE-2014-7844
Published: 2020-01-14
Description: BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
CVSS Score: 7.8 (HIGH)
CWE: CWE-74
References: http://linux.oracle.com/errata/ELSA-2014-1999.html; http://rhn.redhat.com/errata/RHSA-2014-1999.html; http://seclists.org/oss-sec/2014/q4/1066
CVE: CVE-2015-0558
Published: 2020-01-14
Description: The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6, and possibly other routers, uses "1236790" and the MAC address to generate the WPA key.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: http://packetstormsecurity.com/files/129817/Pirelli-Router-P.DG-A4001N-WPA-Key-Reverse-Engineering.html; http://www.exploit-db.com/exploits/35721; https://exchange.xforce.ibmcloud.com/vulnerabilities/99682
CVE: CVE-2015-2325
Published: 2020-01-14
Description: The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-787
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html; https://bugs.exim.org/show_bug.cgi?id=1591; https://fortiguard.com/zeroday/FG-VD-15-015
CVE: CVE-2015-2326
Published: 2020-01-14
Description: The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html; https://bugs.exim.org/show_bug.cgi?id=1592; https://fortiguard.com/zeroday/FG-VD-15-016
CVE: CVE-2019-10995
Published: 2020-01-14
Description: ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phase of the HMI interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/108928; https://www.us-cert.gov/ics/advisories/icsa-19-178-02; http://www.securityfocus.com/bid/108928
CVE: CVE-2019-12398
Published: 2020-01-14
Description: In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/01/14/2; https://lists.apache.org/thread.html/r72487ad6b23d[PII_REDACTED]782f8c93032afe5c72a6bfd23b253352b%40%3Cdev.airflow.apache.org%3E; https://lists.apache.org/thread.html/r72487ad6b23d[PII_REDACTED]782f8c93032afe5c72a6bfd23b253352b%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2020-5852
Published: 2020-01-14
Description: Undisclosed traffic patterns received may cause a disruption of service to the Traffic Management Microkernel (TMM). This vulnerability affects TMM through a virtual server configured with a FastL4 profile. Traffic processing is disrupted while TMM restarts. This issue only impacts specific engineering hotfixes. NOTE: This vulnerability does not affect any of the BIG-IP major, minor or maintenance releases you obtained from downloads.f5.com. The affected Engineering Hotfix builds are as follows: Hotfix-BIGIP-14.1.2.1.0.83.4-ENG Hotfix-BIGIP-12.1.4.1.0.97.6-ENG Hotfix-BIGIP-11.5.4.2.74.291-HF2
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K53590702; https://support.f5.com/csp/article/K53590702
CVE: CVE-2020-5853
Published: 2020-01-14
Description: In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K73183618; https://support.f5.com/csp/article/K73183618
CVE: CVE-2015-1869
Published: 2020-01-14
Description: The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://www.openwall.com/lists/oss-security/2015/04/17/5; https://bugzilla.redhat.com/show_bug.cgi?id=1212861; https://github.com/abrt/abrt/commit/3287aa12eb205cff95cdd00d6d6c5c9a4f8f0eca
CVE: CVE-2015-3147
Published: 2020-01-14
Description: daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59
References: http://rhn.redhat.com/errata/RHSA-2015-1083.html; http://www.openwall.com/lists/oss-security/2015/04/17/5; https://bugzilla.redhat.com/show_bug.cgi?id=1212953
CVE: CVE-2015-3150
Published: 2020-01-14
Description: abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://bugzilla.redhat.com/show_bug.cgi?id=1214457; https://github.com/abrt/abrt/commit/6e811d78e2719988ae291181f5b133af32ce62d8; https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1
CVE: CVE-2015-3151
Published: 2020-01-14
Description: Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3151; https://github.com/abrt/abrt/commit/7a47f57975be0d285a2f20758e4572dca6d9cdd3; https://github.com/abrt/abrt/commit/c796c76341ee846cfb897ed645bac211d7d0a932
CVE: CVE-2015-3159
Published: 2020-01-14
Description: The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges.
CVSS Score: 7.8 (HIGH)
References: https://bugzilla.redhat.com/show_bug.cgi?id=1216962; https://github.com/abrt/abrt/commit/9943a77bca37a0829ccd3784d1dfab37f8c24e7b; https://github.com/abrt/abrt/commit/9a4100678fea4d60ec93d35f4c5de2e9ad054f3a
CVE: CVE-2015-4107
Published: 2020-01-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was intended functionality. Notes: none
CVE: CVE-2019-19548
Published: 2020-01-14
Description: Norton Power Eraser, prior to 5.3.0.67, may be susceptible to a privilege escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user.
CVSS Score: 7.8 (HIGH)
References: https://support.symantec.com/us/en/article.SYMSA1503.html; https://support.symantec.com/us/en/article.SYMSA1503.html
CVE: CVE-2020-5193
Published: 2020-01-14
Description: PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple reflected XSS vulnerabilities via the searchdata or Doctorspecialization parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155929/Hospital-Management-System-4.0-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/155929/Hospital-Management-System-4.0-Cross-Site-Scripting.html
CVE: CVE-2020-6303
Published: 2020-01-14
Description: SAP Disclosure Management, before version 10.1, does not validate user input properly in specific use cases leading to Cross-Site Scripting.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2772325; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771; https://launchpad.support.sap.com/#/notes/2772325
CVE: CVE-2020-6304
Published: 2020-01-14
Description: Improper input validation in SAP NetWeaver Internet Communication Manager (update provided in KRNL32NUC & KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT KRNL64NUC & KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 KERNEL 7.21, 7.49, 7.53) allows an attacker to prevent users from accessing its services through a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2848498; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771; https://launchpad.support.sap.com/#/notes/2848498
CVE: CVE-2020-6305
Published: 2020-01-14
Description: PI Rest Adapter of SAP Process Integration (update provided in SAP_XIAF 7.31, 7.40, 7.50) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2863743; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771; https://launchpad.support.sap.com/#/notes/2863743
CVE: CVE-2020-6306
Published: 2020-01-14
Description: Missing authorization check in a transaction within SAP Leasing (update provided in SAP_APPL 6.18, EA-APPL 6.0, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16 and 6.17).
CVSS Score: 2.7 (LOW)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2865348; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771; https://launchpad.support.sap.com/#/notes/2865348
CVE: CVE-2020-6307
Published: 2020-01-14
Description: Automated Note Search Tool (update provided in SAP Basis 7.0, 7.01, 7.02, 7.31, 7.4, 7.5, 7.51, 7.52, 7.53 and 7.54) does not perform sufficient authorization checks leading to the reading of sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://launchpad.support.sap.com/#/notes/2863397; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=533671771; https://launchpad.support.sap.com/#/notes/2863397
CVE: CVE-2019-13537
Published: 2020-01-14
Description: The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerability that could result in a server-side crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-121, CWE-787
References: https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec139.pdf; https://www.us-cert.gov/ics/advisories/icsa-19-290-01; https://sw.aveva.com/hubfs/assets-2018/pdf/security-bulletin/SecurityBulletin_LFSec139.pdf
CVE: CVE-2019-13722
Published: 2020-01-14
Description: Inappropriate implementation in WebRTC in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://chromereleases.googleblog.com/2019/12/stable-channel-update-for-desktop.html; https://crbug.com/1025089; https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/
CVE: CVE-2019-3981
Published: 2020-01-14
Description: MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed password.
CVSS Score: 3.7 (LOW)
CWE: CWE-300
References: https://www.tenable.com/security/research/tra-2020-01; https://www.tenable.com/security/research/tra-2020-01
CVE: CVE-2020-5180
Published: 2020-01-14
Description: Viscosity 1.8.2 on Windows and macOS allows an unprivileged user to set a subset of OpenVPN parameters, which can be used to load a malicious library into the memory of the OpenVPN process, leading to limited local privilege escalation. (When a VPN connection is initiated using a TLS/SSL client profile, the privileges are dropped, and the library will be loaded, resulting in arbitrary code execution as a user with limited privileges. This greatly reduces the impact of the vulnerability.)
CVSS Score: 7.8 (HIGH)
References: https://www.sparklabs.com/blog/viscosity-for-mac-windows-version-1-8-4/; https://www.sparklabs.com/blog/viscosity-for-mac-windows-version-1-8-4/
CVE: CVE-2020-5505
Published: 2020-01-14
Description: Freelancy v1.0.0 allows remote command execution via the "file":"data:application/x-php;base64 substring (in conjunction with "type":"application/x-php"} to the /api/files/ URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/155922/Freelancy-1.0.0-Remote-Code-Execution.html; http://packetstormsecurity.com/files/155922/Freelancy-1.0.0-Remote-Code-Execution.html
CVE: CVE-2020-5509
Published: 2020-01-14
Description: PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/155925/Car-Rental-Project-1.0-Remote-Code-Execution.html; http://packetstormsecurity.com/files/155925/Car-Rental-Project-1.0-Remote-Code-Execution.html
CVE: CVE-2020-6173
Published: 2020-01-14
Description: TUF (aka The Update Framework) 0.7.2 through 0.12.1 allows Uncontrolled Resource Consumption.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://github.com/theupdateframework/tuf/commits/develop; https://github.com/theupdateframework/tuf/issues/973; https://github.com/theupdateframework/tuf/commits/develop
CVE: CVE-2011-3203
Published: 2020-01-14
Description: A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.openwall.com/lists/oss-security/2011/08/30/6; https://www.openwall.com/lists/oss-security/2011/08/30/6
CVE: CVE-2019-16784
Published: 2020-01-14
Description: In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is present in this particular case: If a software using PyInstaller in "onefile" mode is launched by a privileged user (at least more than the current one) which have his "TempPath" resolving to a world writable directory. This is the case for example if the software is launched as a service or as a scheduled task using a system account (TempPath will be C:\Windows\Temp). In order to be exploitable the software has to be (re)started after the attacker launch the exploit program, so for a service launched at startup, a service restart is needed (e.g. after a crash or an upgrade).
CVSS Score: 7.0 (HIGH)
CWE: CWE-250, CWE-732
References: https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-7fcj-pq9j-wh2r; https://github.com/pyinstaller/pyinstaller/security/advisories/GHSA-7fcj-pq9j-wh2r
CVE: CVE-2011-2706
Published: 2020-01-14
Description: A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://seclists.org/fulldisclosure/2011/May/300; https://www.openwall.com/lists/oss-security/2011/07/20/17; https://seclists.org/fulldisclosure/2011/May/300
CVE: CVE-2011-2933
Published: 2020-01-14
Description: An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://www.openwall.com/lists/oss-security/2011/08/19/12; https://www.openwall.com/lists/oss-security/2011/08/19/12
CVE: CVE-2011-2934
Published: 2020-01-14
Description: A Cross Site Request Forgery (CSRF) vulnerability exists in the administrator functions in WebsiteBaker 2.8.1 and earlier due to inadequate confirmation for sensitive transactions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.openwall.com/lists/oss-security/2011/08/19/13; https://www.openwall.com/lists/oss-security/2011/08/19/13
CVE: CVE-2011-3183
Published: 2020-01-14
Description: A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openwall.com/lists/oss-security/2011/08/22/11; https://www.openwall.com/lists/oss-security/2011/08/22/11
CVE: CVE-2011-3202
Published: 2020-01-14
Description: A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openwall.com/lists/oss-security/2011/08/30/5; https://www.openwall.com/lists/oss-security/2011/08/30/5
CVE: CVE-2016-6592
Published: 2020-01-14
Description: A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that, when placed on the target user's system, will cause the Norton Download Manager component to load the remote user's DLL instead of the intended DLL and execute arbitrary code when the Norton Download Manager component is run by the target user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://www.securityfocus.com/bid/94695; http://www.securityfocus.com/bid/95444; http://www.securitytracker.com/id/1037622
CVE: CVE-2[PII_REDACTED]
Published: 2020-01-14
Description: Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-215, CWE-20
References: https://github.com/kubernetes/ingress-nginx/pull/3125; https://github.com/kubernetes/ingress-nginx/pull/3125
CVE: CVE-2020-7053
Published: 2020-01-14
Description: In the Linux kernel 4.14 longterm through 4.14.165 and 4.19 longterm through 4.19.96 (and 5.x before 5.2), there is a use-after-free (write) in the i915_ppgtt_close function in drivers/gpu/drm/i915/i915_gem_gtt.c, aka CID-7dc40713618c. This is related to i915_gem_context_destroy_ioctl in drivers/gpu/drm/i915/i915_gem_context.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00021.html; http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html; https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1859522
CVE: CVE-2020-7054
Published: 2020-01-14
Description: MmsValue_decodeMmsData in mms/iso_mms/server/mms_access_result.c in libIEC61850 through 1.4.0 has a heap-based buffer overflow when parsing the MMS_BIT_STRING data type.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/mz-automation/libiec61850/issues/200; https://github.com/mz-automation/libiec61850/issues/200
CVE: CVE-2011-2714
Published: 2020-01-14
Description: A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://seclists.org/fulldisclosure/2011/Feb/219; https://www.drupal.org/node/1056470; https://www.openwall.com/lists/oss-security/2011/07/26/8
CVE: CVE-2011-2715
Published: 2020-01-14
Description: An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.drupal.org/node/1056470; https://www.openwall.com/lists/oss-security/2011/07/26/8; https://www.drupal.org/node/1056470
CVE: CVE-2020-7057
Published: 2020-01-14
Description: Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depending on whether the user account exists, which might make it easier to enumerate users. However, only about 4 or 5 failed logins are allowed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307
References: https://sku11army.blogspot.com/2020/01/hikvision-dvr-ds-7204hghi-user.html; https://sku11army.blogspot.com/2020/01/hikvision-dvr-ds-7204hghi-user.html
CVE: CVE-2020-0601
Published: 2020-01-14
Description: A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
CVSS Score: 8.1 (HIGH)
CWE: CWE-295, CWE-295
References: http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html; http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601
CVE: CVE-2020-0602
Published: 2020-01-14
Description: A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://access.redhat.com/errata/RHSA-2020:0130; https://access.redhat.com/errata/RHSA-2020:0134; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0602
CVE: CVE-2020-0603
Published: 2020-01-14
Description: A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://access.redhat.com/errata/RHSA-2020:0130; https://access.redhat.com/errata/RHSA-2020:0134; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603
CVE: CVE-2020-0605
Published: 2020-01-14
Description: A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0605; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0605
CVE: CVE-2020-0606
Published: 2020-01-14
Description: A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0606; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0606