deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8188
Published: 2020-07-02
Description: We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectively that fixes vulnerabilities found on Protect firmware v1.13.2, v1.14.9 and prior according to the description below:View only users can run certain custom commands which allows them to assign themselves unauthorized roles and escalate their privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: https://community.ui.com/releases/Security-advisory-bulletin-012-012/1bba9134-f888-4010-81c0-b0dd53b9bda4; https://community.ui.com/releases/UniFi-Protect-1-13-3/f4be7d35-93a3-422b-8eef-122e442c00ba; https://community.ui.com/releases/UniFi-Protect-1-14-10/48a8dbdd-b872-47fa-bbde-1d24ddf5d5b5
CVE: CVE-2020-15469
Published: 2020-07-02
Description: In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
CVSS Score: 2.3 (LOW)
CWE: CWE-476
References: http://www.openwall.com/lists/oss-security/2020/07/02/1; https://lists.debian.org/debian-lts-announce/2021/02/msg00024.html; https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html
CVE: CVE-2019-20418
Published: 2020-07-03
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to prevent users from accessing the instance via an Application Denial of Service vulnerability in the /rendering/wiki endpoint. The affected versions are before version 8.8.0.
CVSS Score: 6.5 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-70943; https://jira.atlassian.com/browse/JRASERVER-70943
CVE: CVE-2019-20419
Published: 2020-07-03
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The affected versions are before version 8.5.5, and from version 8.6.0 before 8.7.2.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://jira.atlassian.com/browse/JRASERVER-70945; https://jira.atlassian.com/browse/JRASERVER-70945
CVE: CVE-2020-14172
Published: 2020-07-03
Description: This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote code execution via insecure deserialization, if they were able to exploit a server side template injection vulnerability. The affected versions are before version 7.13.0, from version 8.0.0 before 8.5.0, and from version 8.6.0 before version 8.8.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://jira.atlassian.com/browse/JRASERVER-70940; https://jira.atlassian.com/browse/JRASERVER-70940
CVE: CVE-2020-14173
Published: 2020-07-03
Description: The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-70814; https://jira.atlassian.com/browse/JRASERVER-70814
CVE: CVE-2020-15518
Published: 2020-07-03
Description: VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, which allows unprivileged users to achieve total control over filesystem I/O requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://zwclose.github.io/veeamon; https://zwclose.github.io/veeamon
CVE: CVE-2020-7281
Published: 2020-07-03
Description: Privilege Escalation vulnerability in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-269, CWE-269
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062
CVE: CVE-2020-7282
Published: 2020-07-03
Description: Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59, CWE-59
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062
CVE: CVE-2020-7283
Published: 2020-07-03
Description: Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to create and edit files via symbolic link manipulation in a location they would otherwise not have access to. This is achieved through running a malicious script or program on the target machine.
CVSS Score: 7.5 (HIGH)
CWE: CWE-274, CWE-269
References: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062; https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS103062
CVE: CVE-2020-10281
Published: 2020-07-03
Description: This vulnerability applies to the Micro Air Vehicle Link (MAVLink) protocol and allows a remote attacker to gain access to sensitive information provided it has access to the communication medium. MAVLink is a header-based protocol that does not perform encryption to improve transfer (and reception speed) and efficiency by design. The increasing popularity of the protocol (used accross different autopilots) has led to its use in wired and wireless mediums through insecure communication channels exposing sensitive information to a remote attacker with ability to intercept network traffic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://docs.google.com/document/d/1XtbD0ORNkhZ8eKrsbSIZNLyg9sFRXMXbsR2mp37KbIg/edit; https://docs.google.com/document/d/1XtbD0ORNkhZ8eKrsbSIZNLyg9sFRXMXbsR2mp37KbIg/edit
CVE: CVE-2020-10282
Published: 2020-07-03
Description: The Micro Air Vehicle Link (MAVLink) protocol presents no authentication mechanism on its version 1.0 (nor authorization) whichs leads to a variety of attacks including identity spoofing, unauthorized access, PITM attacks and more. According to literature, version 2.0 optionally allows for package signing which mitigates this flaw. Another source mentions that MAVLink 2.0 only provides a simple authentication system based on HMAC. This implies that the flying system overall should add the same symmetric key into all devices of network. If not the case, this may cause a security issue, that if one of the devices and its symmetric key are compromised, the whole authentication system is not reliable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://github.com/rligocki/Diploma_thesis_px4; https://github.com/rligocki/Diploma_thesis_px4
CVE: CVE-2020-7284
Published: 2020-07-03
Description: Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to gain unauthorised access to the root account via execution of carefully crafted commands from the restricted command line interface (CLI).
CVSS Score: 8.6 (HIGH)
CWE: CWE-200, CWE-200
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10322; https://kc.mcafee.com/corporate/index?page=content&id=SB10322
CVE: CVE-2020-15523
Published: 2020-07-04
Description: In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-908
References: https://bugs.python.org/issue29778; https://github.com/python/cpython/pull/21297; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-15528
Published: 2020-07-05
Description: An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file permissions and missing file integrity checks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://daniels-it-blog.blogspot.com/2020/07/gog-galaxy-escalation-of-privileges.html; http://daniels-it-blog.blogspot.com/2020/07/gog-galaxy-escalation-of-privileges.html
CVE: CVE-2020-15529
Published: 2020-07-05
Description: An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists because of weak file permissions and can be exploited by using opportunistic locks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-667, CWE-732
References: http://daniels-it-blog.blogspot.com/2020/07/gog-galaxy-escalation-of-privileges.html; http://daniels-it-blog.blogspot.com/2020/07/gog-galaxy-escalation-of-privileges.html
CVE: CVE-2020-15530
Published: 2020-07-05
Description: An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\SYSTEM privileges because some parts of %PROGRAMFILES(X86)%\Steam and/or %COMMONPROGRAMFILES(X86)%\Steam have weak permissions during a critical time window. An attacker can make this time window arbitrarily long by using opportunistic locks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362
References: http://daniels-it-blog.blogspot.com/2020/07/steam-arbitrary-code-execution-part-2.html; http://daniels-it-blog.blogspot.com/2020/07/steam-arbitrary-code-execution-part-2.html
CVE: CVE-2020-15466
Published: 2020-07-05
Description: In Wireshark 3.2.0 to 3.2.4, the GVCP dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-gvcp.c by ensuring that an offset increases in all situations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00038.html; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16029
CVE: CVE-2020-15535
Published: 2020-07-05
Description: An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/157118/WordPress-Car-Rental-System-1.3-Cross-Site-Scripting.html; https://wpvulndb.com/vulnerabilities/10172; https://packetstormsecurity.com/files/157118/WordPress-Car-Rental-System-1.3-Cross-Site-Scripting.html
CVE: CVE-2020-15536
Published: 2020-07-05
Description: An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/157116/WordPress-Hotel-Booking-System-Pro-1.1-Cross-Site-Scripting.html; https://wpvulndb.com/vulnerabilities/10171; https://packetstormsecurity.com/files/157116/WordPress-Hotel-Booking-System-Pro-1.1-Cross-Site-Scripting.html
CVE: CVE-2020-15537
Published: 2020-07-05
Description: An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/157099/Vanguard-2.1-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-15538
Published: 2020-07-05
Description: XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/157886/We-Com-Municipality-Portal-CMS-2.1.x-Cross-Site-Scripting-SQL-Injection.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-15539
Published: 2020-07-05
Description: SQL injection can occur in We-com Municipality portal CMS 2.1.x via the cerca/ keywords field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/157886/We-Com-Municipality-Portal-CMS-2.1.x-Cross-Site-Scripting-SQL-Injection.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-15540
Published: 2020-07-05
Description: We-com OpenData CMS 2.0 allows SQL Injection via the username field on the administrator login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/157887/We-Com-OpenData-CMS-2.0-SQL-Injection.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-15541
Published: 2020-07-05
Description: SolarWinds Serv-U FTP server before 15.2.1 allows remote command execution.
CVSS Score: 9.8 (CRITICAL)
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE: CVE-2020-15542
Published: 2020-07-05
Description: SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command.
CVSS Score: 9.8 (CRITICAL)
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE: CVE-2020-15543
Published: 2020-07-05
Description: SolarWinds Serv-U FTP server before 15.2.1 does not validate an argument path.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-1_release_notes.htm
CVE: CVE-2020-15562
Published: 2020-07-06
Description: An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00083.html; https://github.com/roundcube/roundcubemail/commit/3e8832d029b035e3fcfb4c75839567a9580b4f82; https://github.com/roundcube/roundcubemail/releases/tag/1.2.11
CVE: CVE-2020-7690
Published: 2020-07-06
Description: All affected versions <2.0.0 of package jspdf are vulnerable to Cross-site Scripting (XSS). It is possible to inject JavaScript code via the html method.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/MrRio/jsPDF/issues/2795; https://snyk.io/vuln/SNYK-JS-JSPDF-575256; https://github.com/MrRio/jsPDF/issues/2795
CVE: CVE-2020-7691
Published: 2020-07-06
Description: In all versions of the package jspdf, it is possible to use <<script>script> in order to go over the filtering regex.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-575255; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-575253; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBMRRIO-575254
CVE: CVE-2020-15569
Published: 2020-07-06
Description: PlayerGeneric.cpp in MilkyTracker through 1.02.00 has a use-after-free in the PlayerGeneric destructor.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://github.com/milkytracker/MilkyTracker/commit/7afd55c42ad80d01a339197a2d8b5461d214edaf; https://lists.debian.org/debian-lts-announce/2020/07/msg00023.html; https://github.com/milkytracker/MilkyTracker/commit/7afd55c42ad80d01a339197a2d8b5461d214edaf
CVE: CVE-2020-15570
Published: 2020-07-06
Description: The parse_report() function in whoopsie.c in Whoopsie through 0.2.69 mishandles memory allocation failures, which allows an attacker to cause a denial of service via a malformed crash file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/sungjungk/whoopsie_killer2/blob/master/README.md; https://github.com/sungjungk/whoopsie_killer2/blob/master/whoopsie_killer2.py; https://launchpad.net/ubuntu/+source/whoopsie
CVE: CVE-2019-8066
Published: 2020-07-06
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]8 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html; https://helpx.adobe.com/security/products/acrobat/apsb19-41.html
CVE: CVE-2019-8249
Published: 2020-07-06
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]8 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html; https://helpx.adobe.com/security/products/acrobat/apsb19-41.html
CVE: CVE-2019-8250
Published: 2020-07-06
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]8 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html; https://helpx.adobe.com/security/products/acrobat/apsb19-41.html
CVE: CVE-2019-8251
Published: 2020-07-06
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]8 and earlier have a type confusion vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843
References: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html; https://helpx.adobe.com/security/products/acrobat/apsb19-41.html
CVE: CVE-2019-8252
Published: 2020-07-06
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]5 and earlier, 2[PII_REDACTED]2 and earlier, 2[PII_REDACTED]3 and earlier, 2[PII_REDACTED]7 and earlier, and 2[PII_REDACTED]8 and earlier have a type confusion vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-843
References: https://helpx.adobe.com/security/products/acrobat/apsb19-41.html; https://helpx.adobe.com/security/products/acrobat/apsb19-41.html
CVE: CVE-2020-14303
Published: 2020-07-06
Description: A flaw was found in the AD DC NBT server in all Samba versions before 4.10.17, before 4.11.11 and before 4.12.4. A samba user could send an empty UDP packet to cause the samba server to crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-834
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00030.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00002.html
CVE: CVE-2020-1837
Published: 2020-07-06
Description: ChangXiang 8 Plus with versions earlier than 9.1.0.136(C00E121R1P6T8) have a denial of service vulnerability. The device does not properly handle certain message from base station, the attacker could craft a fake base station to launch the attack. Successful exploit could cause a denial of signal service condition.
CVSS Score: 5.3 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200624-01-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200624-01-dos-en
CVE: CVE-2020-5352
Published: 2020-07-06
Description: Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulnerability to execute arbitrary commands on the affected system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.dell.com/support/security/en-us/details/542719/DSA-2020-081-Dell-EMC-Data-Protection-Advisor-OS-Command-Injection-Vulnerability; https://www.dell.com/support/security/en-us/details/542719/DSA-2020-081-Dell-EMC-Data-Protection-Advisor-OS-Command-Injection-Vulnerability
CVE: CVE-2020-5356
Published: 2020-07-06
Description: Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines.
CVSS Score: 7.7 (HIGH)
CWE: CWE-285, CWE-552
References: https://www.dell.com/support/security/en-us/details/544733/DSA-2020-099-Dell-PowerProtect-Data-Manager-Improper-Authorization-Vulnerability; https://www.dell.com/support/security/en-us/details/544733/DSA-2020-099-Dell-PowerProtect-Data-Manager-Improper-Authorization-Vulnerability
CVE: CVE-2020-5368
Published: 2020-07-06
Description: Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attacker may exploit this vulnerability to obtain sensitive information in an encrypted form.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://www.dell.com/support/security/en-us/details/544058/DSA-2020-136-Dell-EMC-VxRail-Appliance-Improper-Authentication-Vulnerability; https://www.dell.com/support/security/en-us/details/544058/DSA-2020-136-Dell-EMC-VxRail-Appliance-Improper-Authentication-Vulnerability
CVE: CVE-2020-5371
Published: 2020-07-06
Description: Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions vulnerability. An attacker, with network or local file access, could take advantage of insufficiently applied file permissions or gain unauthorized access to files.
CVSS Score: 8.0 (HIGH)
CWE: CWE-732, CWE-732
References: https://www.dell.com/support/security/en-us/details/544593/DSA-2020-155-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-Security-Update-for-a-Permissions-Vuln; https://www.dell.com/support/security/en-us/details/544593/DSA-2020-155-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-Security-Update-for-a-Permissions-Vuln
CVE: CVE-2020-5372
Published: 2020-07-06
Description: Dell EMC PowerStore versions prior to 1.0.1.0.5.002 contain a vulnerability that exposes test interface ports to external network. A remote unauthenticated attacker could potentially cause Denial of Service via test interface ports which are not used during run time environment.
CVSS Score: 8.6 (HIGH)
CWE: CWE-1244, CWE-863
References: https://www.dell.com/support/security/en-us/details/544738/DSA-2020-159-Dell-EMC-PowerStore-Family-Improper-Authorization-Vulnerability; https://www.dell.com/support/security/en-us/details/544738/DSA-2020-159-Dell-EMC-PowerStore-Family-Improper-Authorization-Vulnerability