deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15641
Published: 2020-08-25
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getFileUploadBytes method of the FlashValidatorServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10499.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-969/; https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf
CVE: CVE-2020-15642
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the isHPSmartComponent method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10501.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-970/; https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf
CVE: CVE-2020-15643
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the saveAsText method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10549.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.tenable.com/security/research/tra-2020-56; https://www.zerodayinitiative.com/advisories/ZDI-20-971/
CVE: CVE-2020-15644
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the setAppFileBytes method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10550.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.tenable.com/security/research/tra-2020-56; https://www.zerodayinitiative.com/advisories/ZDI-20-972/
CVE: CVE-2020-15645
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the getFileFromURL method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10553.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.tenable.com/security/research/tra-2020-56; https://www.zerodayinitiative.com/advisories/ZDI-20-973/
CVE: CVE-2020-17387
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the writeObjectToConfigFile method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10565.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-974/; https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf
CVE: CVE-2020-17388
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Tomcat configuration file. The issue results from the lack of proper restriction to the Tomcat admin console. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10799.
CVSS Score: 8.8 (HIGH)
CWE: CWE-749
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-975/; https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf
CVE: CVE-2020-17389
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the decryptFile method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10502.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-976/; https://www.marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf
CVE: CVE-2020-17390
Published: 2020-08-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the hypervisor kernel extension. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-10030.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1008/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17391
Published: 2020-08-25
Description: This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handler for HOST_IOCTL_INIT_HYPERVISOR in the prl_hypervisor kext. The issue results from the exposure of dangerous method or function to the unprivileged user. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-10518.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-749
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1009/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17392
Published: 2020-08-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handler for HOST_IOCTL_SET_KERNEL_SYMBOLS in the prl_hypervisor kext. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-10519.
CVSS Score: 8.8 (HIGH)
CWE: CWE-822
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1010/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17393
Published: 2020-08-25
Description: This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result a pointer to be leaked after the handler is done. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-10520.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1011/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17394
Published: 2020-08-25
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the OEMNet component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11132.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-129
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1012/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17395
Published: 2020-08-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the prl_naptd process. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11134.
CVSS Score: 8.2 (HIGH)
CWE: CWE-191
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1013/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17396
Published: 2020-08-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11217.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1014/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17397
Published: 2020-08-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the handling of network packets. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11253.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1015/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17398
Published: 2020-08-25
Description: This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-11302.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-129
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1016/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17399
Published: 2020-08-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11303.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1017/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17400
Published: 2020-08-25
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11304.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1018/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17401
Published: 2020-08-25
Description: This vulnerability allows local attackers to disclose sensitive informations on affected installations of Parallels Desktop 15.1.4. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the VGA virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated array. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-11363.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-129, CWE-129
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1019/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17402
Published: 2020-08-25
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4 (47270). An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the prl_hypervisor kext. By examining a log file, an attacker can disclose a memory address. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-11063.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://kb.parallels.com/en/125013; https://www.zerodayinitiative.com/advisories/ZDI-20-1020/; https://kb.parallels.com/en/125013
CVE: CVE-2020-17403
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11003.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1078/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-17404
Published: 2020-08-25
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.922. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11191.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1079/; https://www.foxitsoftware.com/support/security-bulletins.html
CVE: CVE-2020-15777
Published: 2020-08-25
Description: An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list, thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used to achieve remote code execution and local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://docs.gradle.com/enterprise/maven-extension/#1_6; https://security.gradle.com/advisory/CVE-2020-15777; https://docs.gradle.com/enterprise/maven-extension/#1_6
CVE: CVE-2020-19005
Published: 2020-08-25
Description: zrlog v2.1.0 has a vulnerability with the permission check. If admin account is logged in, other unauthorized users can download the database backup file directly.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-863
References: https://github.com/94fzb/zrlog/commit/b2b4415e2e59b6f18b0a62b633e71c96d63c43ba; https://github.com/94fzb/zrlog/issues/48; https://github.com/94fzb/zrlog/commit/b2b4415e2e59b6f18b0a62b633e71c96d63c43ba
CVE: CVE-2019-14904
Published: 2020-08-26
Description: A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20, CWE-78
References: https://bugzilla.redhat.com/show_bug.cgi?id=1776944; https://github.com/ansible/ansible/pull/65686; https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html
CVE: CVE-2020-24653
Published: 2020-08-26
Description: secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVICE_ONLY is used.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/expo/expo/pull/9264; https://github.com/expo/expo/pull/9264
CVE: CVE-2020-24656
Published: 2020-08-26
Description: Maltego before 4.2.12 allows XXE attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611
References: https://www.hackersforchange.com/post/maltego-cve-2020-24656-analysis; https://www.maltego.com/changelog/; https://www.hackersforchange.com/post/maltego-cve-2020-24656-analysis
CVE: CVE-2020-7309
Published: 2020-08-26
Description: Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.
CVSS Score: 3.9 (LOW)
CWE: CWE-79, CWE-79
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10324; https://kc.mcafee.com/corporate/index?page=content&id=SB10324
CVE: CVE-2020-16193
Published: 2020-08-26
Description: osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info['notes'] call.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/osTicket/osTicket/blob/develop/include/staff/banrule.inc.php#L67; https://github.com/osTicket/osTicket/pull/5616/commits/fb570820ef1138776f929a179906e1d8089179d9; https://github.com/osTicket/osTicket/blob/develop/include/staff/banrule.inc.php#L67
CVE: CVE-2020-15498
Published: 2020-08-26
Description: An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. The router accepts an arbitrary server certificate for a firmware update. The culprit is the --no-check-certificate option passed to wget tool used to download firmware update files.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=27440; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=27440