deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10927
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue results from the use of an inappropriate encryption algorithm. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9649.
CVSS Score: 8.8 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.zerodayinitiative.com/advisories/ZDI-20-707/; https://www.zerodayinitiative.com/advisories/ZDI-20-707/
CVE: CVE-2020-10928
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9767.
CVSS Score: 8.4 (HIGH)
CWE: CWE-122
References: https://www.zerodayinitiative.com/advisories/ZDI-20-708/; https://www.zerodayinitiative.com/advisories/ZDI-20-708/
CVE: CVE-2020-10929
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-9768.
CVSS Score: 8.8 (HIGH)
CWE: CWE-680, CWE-190
References: https://www.zerodayinitiative.com/advisories/ZDI-20-709/; https://www.zerodayinitiative.com/advisories/ZDI-20-709/
CVE: CVE-2020-10930
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of URLs. The issue results from the lack of proper routing of URLs. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-9618.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://www.zerodayinitiative.com/advisories/ZDI-20-711/; https://www.zerodayinitiative.com/advisories/ZDI-20-711/
CVE: CVE-2020-15416
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9703.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-20-712/; https://www.zerodayinitiative.com/advisories/ZDI-20-712/
CVE: CVE-2020-15417
Published: 2020-07-28
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. A crafted gui_region in a string table file can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9756.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-121
References: https://www.zerodayinitiative.com/advisories/ZDI-20-713/; https://www.zerodayinitiative.com/advisories/ZDI-20-713/
CVE: CVE-2020-15418
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10709.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.veeam.com/kb3221; https://www.zerodayinitiative.com/advisories/ZDI-20-821/; https://www.veeam.com/kb3221
CVE: CVE-2020-15419
Published: 2020-07-28
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10710.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.veeam.com/kb3221; https://www.zerodayinitiative.com/advisories/ZDI-20-822/; https://www.veeam.com/kb3221
CVE: CVE-2020-15899
Published: 2020-07-28
Description: Grin 3.0.0 before 4.0.0 has insufficient validation of data related to Mimblewimble.
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://github.com/mimblewimble/grin-security/blob/master/CVEs/CVE-2020-15899.md; https://github.com/mimblewimble/grin/compare/v3.1.1...v4.0.0; https://github.com/mimblewimble/grin-security/blob/master/CVEs/CVE-2020-15899.md
CVE: CVE-2020-5377
Published: 2020-07-28
Description: Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22, CWE-22
References: http://packetstormsecurity.com/files/162110/Dell-OpenManage-Server-Administrator-9.4.0.0-File-Read.html; https://www.dell.com/support/article/en-us/sln322304/dsa-2020-172-dell-emc-openmanage-server-administrator-omsa-path-traversal-vulnerability?lang=en; http://packetstormsecurity.com/files/162110/Dell-OpenManage-Server-Administrator-9.4.0.0-File-Read.html
CVE: CVE-2020-16094
Published: 2020-07-28
Description: In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursion into subdirectories during a rebuild of the folder tree.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CRKHUOVTJBHT53J4CYU53PXYYQKSGEA/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBLHUG2UCXVABAGN5FVTD3AB3YKE5NN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YNJIXYDMSXYDII4ERMQ4EEKZX64U3QR4/
CVE: CVE-2020-10982
Published: 2020-07-28
Description: Gambio GX before 4.0.1.0 allows SQL Injection in admin/gv_mail.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2020-0033/; https://herolab.usd.de/security-advisories/
CVE: CVE-2020-10983
Published: 2020-07-28
Description: Gambio GX before 4.0.1.0 allows SQL Injection in admin/mobile.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2020-0034/; https://herolab.usd.de/security-advisories/
CVE: CVE-2020-10984
Published: 2020-07-28
Description: Gambio GX before 4.0.1.0 allows admin/admin.php CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2020-0031/; https://herolab.usd.de/security-advisories/
CVE: CVE-2020-10985
Published: 2020-07-28
Description: Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2020-0035/; https://herolab.usd.de/security-advisories/
CVE: CVE-2020-11474
Published: 2020-07-28
Description: NCP Secure Enterprise Client before 10.15 r47589 allows a symbolic link attack on enumusb.reg via Support Assistant.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://herolab.usd.de/security-advisories/; https://herolab.usd.de/security-advisories/usd-2020-0038/; https://herolab.usd.de/security-advisories/
CVE: CVE-2020-11476
Published: 2020-07-28
Description: Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/concrete5/concrete5/pull/8713; https://github.com/concrete5/concrete5/releases/tag/8.5.3; https://herolab.usd.de/security-advisories/
CVE: CVE-2020-13970
Published: 2020-07-28
Description: Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020; https://www.shopware.com/en/changelog/#6-2-3; https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020
CVE: CVE-2020-13971
Published: 2020-07-28
Description: In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020; https://www.shopware.com/en/changelog/#6-2-3; https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020
CVE: CVE-2020-13997
Published: 2020-07-28
Description: In Shopware before 6.2.3, the database password is leaked to an unauthenticated user when a DriverException occurs and verbose error handling is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020; https://www.shopware.com/en/changelog/#6-2-3; https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-07-2020
CVE: CVE-2020-6098
Published: 2020-07-28
Description: An exploitable denial of service vulnerability exists in the freeDiameter functionality of freeDiameter 1.3.2. A specially crafted Diameter request can trigger a memory corruption resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191, CWE-191, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1030; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1030
CVE: CVE-2020-5612
Published: 2020-07-29
Description: Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN48194211/index.html; https://kujirahand.com/konawiki/; https://jvn.jp/en/jp/JVN48194211/index.html
CVE: CVE-2020-5613
Published: 2020-07-29
Description: Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN48194211/index.html; https://kujirahand.com/konawiki/; https://jvn.jp/en/jp/JVN48194211/index.html
CVE: CVE-2020-5614
Published: 2020-07-29
Description: Directory traversal vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN48194211/index.html; https://kujirahand.com/konawiki/; https://jvn.jp/en/jp/JVN48194211/index.html
CVE: CVE-2020-14489
Published: 2020-07-29
Description: OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01; https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01
CVE: CVE-2020-14490
Published: 2020-07-29
Description: OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01; https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01
CVE: CVE-2020-14492
Published: 2020-07-29
Description: OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01; https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01
CVE: CVE-2020-14493
Published: 2020-07-29
Description: A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01; https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01
CVE: CVE-2020-7697
Published: 2020-07-29
Description: This affects all versions of package mock2easy. a malicious user could inject commands through the _data variable: Affected Area require('../server/getJsonByCurl')(mock2easy, function (error, stdout) { if (error) { return res.json(500, error); } res.json(JSON.parse(stdout)); }, '', _data.interfaceUrl, query, _data.cookie,_data.interfaceType);
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://snyk.io/vuln/SNYK-JS-MOCK2EASY-572312; https://www.npmjs.com/package/mock2easy; https://snyk.io/vuln/SNYK-JS-MOCK2EASY-572312
CVE: CVE-2020-7698
Published: 2020-07-29
Description: This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn’t being sanitized.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78
References: https://github.com/Gerapy/Gerapy/commit/e8446605eb[PII_REDACTED]eae199ec7aad573da2d2; https://snyk.io/vuln/SNYK-PYTHON-GERAPY-572470; https://github.com/Gerapy/Gerapy/commit/e8446605eb[PII_REDACTED]eae199ec7aad573da2d2
CVE: CVE-2020-9689
Published: 2020-07-29
Description: Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/magento/apsb20-47.html; https://helpx.adobe.com/security/products/magento/apsb20-47.html
CVE: CVE-2020-9690
Published: 2020-07-29
Description: Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have an observable timing discrepancy vulnerability. Successful exploitation could lead to signature verification bypass.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-203
References: https://helpx.adobe.com/security/products/magento/apsb20-47.html; https://helpx.adobe.com/security/products/magento/apsb20-47.html
CVE: CVE-2020-9691
Published: 2020-07-29
Description: Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb20-47.html; https://helpx.adobe.com/security/products/magento/apsb20-47.html
CVE: CVE-2020-9692
Published: 2020-07-29
Description: Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a security mitigation bypass vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 6.5 (MEDIUM)
References: https://helpx.adobe.com/security/products/magento/apsb20-47.html; https://helpx.adobe.com/security/products/magento/apsb20-47.html
CVE: CVE-2020-14486
Published: 2020-07-29
Description: An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-285, CWE-863
References: https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01; https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01
CVE: CVE-2020-14487
Published: 2020-07-29
Description: OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-912
References: https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01; https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01
CVE: CVE-2020-14488
Published: 2020-07-29
Description: OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434, CWE-434
References: https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01; https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01
CVE: CVE-2020-2076
Published: 2020-07-29
Description: SICK Package Analytics software up to and including version V04.0.0 are vulnerable to an authentication bypass by directly interfacing with the REST API. An attacker can send unauthorized requests, bypass current authentication controls presented by the application and could potentially write files without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories; https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE: CVE-2020-2077
Published: 2020-07-29
Description: SICK Package Analytics software up to and including version V04.0.0 are vulnerable due to incorrect default permissions settings. An unauthorized attacker could read sensitive data from the system by querying for known files using the REST API directly.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories; https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE: CVE-2020-2078
Published: 2020-07-29
Description: Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1. An authorized attacker could access these stored plaintext credentials and gain access to the ftp service. Storing a password in plaintext allows attackers to easily gain access to systems, potentially compromising personal information or other sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories; https://www.sick.com/de/en/service-and-support/the-sick-product-security-incident-response-team-sick-psirt/w/psirt/#advisories
CVE: CVE-2020-4463
Published: 2020-07-29
Description: IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181484; https://www.ibm.com/support/pages/node/6253953; https://exchange.xforce.ibmcloud.com/vulnerabilities/181484
CVE: CVE-2020-4567
Published: 2020-07-29
Description: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 184156.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184156; https://www.ibm.com/support/pages/node/6253781; https://exchange.xforce.ibmcloud.com/vulnerabilities/184156
CVE: CVE-2020-4569
Published: 2020-07-29
Description: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. IBM X-Force ID: 184158.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184158; https://www.ibm.com/support/pages/node/6253781; https://exchange.xforce.ibmcloud.com/vulnerabilities/184158
CVE: CVE-2020-4572
Published: 2020-07-29
Description: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184179.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184179; https://www.ibm.com/support/pages/node/6253781; https://exchange.xforce.ibmcloud.com/vulnerabilities/184179
CVE: CVE-2020-4573
Published: 2020-07-29
Description: IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM X-Force ID: 184180.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184180; https://www.ibm.com/support/pages/node/6253781; https://exchange.xforce.ibmcloud.com/vulnerabilities/184180
CVE: CVE-2020-4574
Published: 2020-07-29
Description: IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 184181.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184181; https://www.ibm.com/support/pages/node/6253781; https://exchange.xforce.ibmcloud.com/vulnerabilities/184181
CVE: CVE-2020-4644
Published: 2020-07-29
Description: IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 185716.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-1021
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185716; https://www.ibm.com/support/pages/node/6253355; https://exchange.xforce.ibmcloud.com/vulnerabilities/185716