deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3703
Published: 2020-11-02
Description: u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link Layer Length Overfow issue (CVE-2019-16336,CVE-2019-17519) and Silent Length Overflow issue(CVE-2019-17518) mentioned in sweyntooth paper)' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8076, AR9344, Bitra, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, Nicobar, QCA6174A, QCA9377, QCM2150, QCM6125, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SC8180X, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin
CVE: CVE-2020-3704
Published: 2020-11-02
Description: u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral system enter into dead lock state.(This CVE is equivalent to InvalidConnectionRequest(CVE-2019-19193) mentioned in sweyntooth paper)' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8017, APQ8053, AR9344, Bitra, IPQ5018, Kamorta, MDM9607, MDM9640, MDM9650, MSM8996AU, Nicobar, QCA6174A, QCA6390, QCA6574AU, QCA9377, QCA9886, QCM6125, QCN7605, QCS404, QCS405, QCS605, QCS610, QRB5165, Rennell, SA415M, SA515M, Saipan, SC7180, SC8180X, SDA845, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2020-bulletin
CVE: CVE-2018-19950
Published: 2020-11-02
Description: If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-20-10; https://www.qnap.com/en/security-advisory/qsa-20-10
CVE: CVE-2018-19951
Published: 2020-11-02
Description: If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-20-10; https://www.qnap.com/en/security-advisory/qsa-20-10
CVE: CVE-2018-19952
Published: 2020-11-02
Description: If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-80, CWE-943, CWE-89
References: https://www.qnap.com/en/security-advisory/qsa-20-10; https://www.qnap.com/en/security-advisory/qsa-20-10
CVE: CVE-2018-19954
Published: 2020-11-02
Description: The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-20-11; https://www.qnap.com/en/security-advisory/qsa-20-11
CVE: CVE-2018-19955
Published: 2020-11-02
Description: The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-20-11; https://www.qnap.com/en/security-advisory/qsa-20-11
CVE: CVE-2018-19956
Published: 2020-11-02
Description: The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-80, CWE-79
References: https://www.qnap.com/en/security-advisory/qsa-20-11; https://www.qnap.com/en/security-advisory/qsa-20-11
CVE: CVE-2018-17932
Published: 2020-11-02
Description: JUUKO K-800 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.) is vulnerable to a replay attack and command forgery, which could allow attackers to replay commands, control the device, view commands, or cause the device to stop running.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-301-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-301-01
CVE: CVE-2018-19025
Published: 2020-11-02
Description: In JUUKO K-808, an attacker could specially craft a packet that encodes an arbitrary command, which could be executed on the K-808 (Firmware versions prior to numbers ending ...9A, ...9B, ...9C, etc.).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-294
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-301-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-301-01
CVE: CVE-2020-10937
Published: 2020-11-02
Description: An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.
CVSS Score: 7.5 (HIGH)
References: https://blog.ipfs.io/2020-10-30-dht-hardening/; https://graz.pure.elsevier.com/en/publications/total-eclipse-of-the-heart-disrupting-the-interplanetary-file-sys; https://blog.ipfs.io/2020-10-30-dht-hardening/
CVE: CVE-2020-14425
Published: 2020-11-02
Description: Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/159784/Foxit-Reader-9.7.1-Remote-Command-Execution.html; https://www.exploit-db.com/exploits/48982; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-14750
Published: 2020-11-02
Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html; https://www.oracle.com/security-alerts/alert-cve-2020-14750.html; http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html
CVE: CVE-2020-15914
Published: 2020-11-02
Description: A cross-site scripting (XSS) vulnerability exists in the Origin Client for Mac and PC 10.5.86 or earlier that could allow a remote attacker to execute arbitrary Javascript in a target user’s Origin client. An attacker could use this vulnerability to access sensitive data related to the target user’s Origin account, or to control or monitor the Origin text chat window.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Monairy/Security-Advisories/blob/master/CVE%[PII_REDACTED]4; https://www.ea.com/security/news/easec-2020-003-cross-site-scripting-vulnerability-in-origin-client; https://github.com/Monairy/Security-Advisories/blob/master/CVE%[PII_REDACTED]4
CVE: CVE-2020-23639
Published: 2020-11-02
Description: A command injection vulnerability exists in Moxa Inc VPort 461 Series Firmware Version 3.4 or lower that could allow a remote attacker to execute arbitrary commands in Moxa's VPort 461 Series Industrial Video Servers.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://www.moxa.com/en/support/support/security-advisory/vport-461-series-industrial-video-servers-vulnerabilities; https://www.moxa.com/en/support/support/security-advisory/vport-461-series-industrial-video-servers-vulnerabilities
CVE: CVE-2020-24881
Published: 2020-11-02
Description: SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: http://packetstormsecurity.com/files/160995/osTicket-1.14.2-Server-Side-Request-Forgery.html; https://blackbatsec.medium.com/cve-2020-24881-server-side-request-forgery-in-osticket-eea175e147f0; https://github.com/osTicket/osTicket/commit/d98c2d096aeb8876c6ab2f88317cd371d781f14d
CVE: CVE-2020-25689
Published: 2020-11-02
Description: A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-401, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689
CVE: CVE-2020-27358
Published: 2020-11-02
Description: An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation threads as CSV) allows non-privileged users to export one another's conversation threads by changing the thread_id parameter in the request to the endpoint Messenger/messenger_download_csv.php?title=Hey&thread_id={THREAD_ID}.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: https://github.com/seb1055/cve-2020-27358-27359; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/; https://www.ruse.tech/blog/38
CVE: CVE-2020-27359
Published: 2020-11-02
Description: A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a message and send it to anyone on the platform including admins. The XSS payload would execute on the other account without interaction from the user on several pages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/seb1055/cve-2020-27358-27359; https://www.evms.edu/research/resources_services/redcap/redcap_change_log/; https://www.ruse.tech/blog/38
CVE: CVE-2020-27708
Published: 2020-11-02
Description: A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system and perform actions otherwise reserved for high privileged users or system Administrators.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client; https://www.ea.com/security/news/easec-2020-002-elevation-of-privilege-vulnerability-in-origin-client
CVE: CVE-2020-27982
Published: 2020-11-02
Description: IceWarp 11.4.5.0 allows XSS via the language parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]; http://packetstormsecurity.com/files/159763/Icewarp-WebMail-11.4.5.0-Cross-Site-Scripting.html
CVE: CVE-2020-27992
Published: 2020-11-02
Description: Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Wondershare\dr.fone\Library\DriverInstaller has Full Control for BUILTIN\Users.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://drfone.wondershare.com; https://packetstormsecurity.com/files/159775/Wondershare-Dr.Fone-3.0.0-Unquoted-Service-Path.html; https://drfone.wondershare.com
CVE: CVE-2020-28002
Published: 2020-11-02
Description: In SonarQube 8.4.2.36762, an external attacker can achieve authentication bypass through SonarScanner. With an empty value for the -D sonar.login option, anonymous authentication is forced. This allows creating and overwriting public and private projects via the /api/ce/submit endpoint.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://csl.com.co/sonarqube-auditando-al-auditor-parte-ii/; https://csl.com.co/sonarqube-auditando-al-auditor-parte-ii/
CVE: CVE-2020-28030
Published: 2020-11-02
Description: In Wireshark 3.2.0 to 3.2.7, the GQUIC dissector could crash. This was addressed in epan/dissectors/packet-gquic.c by correcting the implementation of offset advancement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-682, CWE-770, CWE-835
References: https://gitlab.com/wireshark/wireshark/-/commit/b287e7165e8aa89cde6ae37e7c257c5d87d16b9b; https://gitlab.com/wireshark/wireshark/-/issues/16887; https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
CVE: CVE-2020-28031
Published: 2020-11-02
Description: eramba through c2.8.1 allows HTTP Host header injection with (for example) resultant wkhtml2pdf PDF printing by authenticated users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-74
References: https://discussions.eramba.org/t/bug-injectable-host-header-security-issue/1719; https://www.eramba.org/releases; https://discussions.eramba.org/t/bug-injectable-host-header-security-issue/1719
CVE: CVE-2020-28032
Published: 2020-11-02
Description: WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda[PII_REDACTED]d3cd79d3; https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
CVE: CVE-2020-28033
Published: 2020-11-02
Description: WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed.
CVSS Score: 7.5 (HIGH)
References: https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
CVE: CVE-2020-28034
Published: 2020-11-02
Description: WordPress before 5.5.2 allows XSS associated with global variables.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
CVE: CVE-2020-28035
Published: 2020-11-02
Description: WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC.
CVSS Score: 9.8 (CRITICAL)
References: https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAVVYJKA2I6CRQUINECDPBGWMQDEG244/
CVE: CVE-2020-28036
Published: 2020-11-02
Description: wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/WordPress/wordpress-develop/commit/c9e6b98968025b[PII_REDACTED]d12c3102165a7d32; https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
CVE: CVE-2020-28037
Published: 2020-11-02
Description: is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-754
References: https://github.com/WordPress/wordpress-develop/commit/2ca15d1e5ce70493c5c0c096ca0c76503d6da07c; https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
CVE: CVE-2020-28038
Published: 2020-11-02
Description: WordPress before 5.5.2 allows stored XSS via post slugs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.ripstech.com; https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
CVE: CVE-2020-28039
Published: 2020-11-02
Description: is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/WordPress/wordpress-develop/commit/d5ddd6d4be1bc9fd16b7796842e6fb26315705ad; https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
CVE: CVE-2020-28040
Published: 2020-11-02
Description: WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://blog.wpscan.com/2020/10/30/wordpress-5.5.2-security-release.html; https://lists.debian.org/debian-lts-announce/2020/11/msg00004.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CHHVNK2WYAM3ZTCXTFSEIT56IKLVJHU3/
CVE: CVE-2020-28041
Published: 2020-11-02
Description: The SIP ALG implementation on NETGEAR Nighthawk R7000 1.0.9.64_10.2.64 devices allows remote attackers to communicate with arbitrary TCP and UDP services on a victim's intranet machine, if the victim visits an attacker-controlled web site with a modern browser, aka NAT Slipstreaming. This occurs because the ALG takes action based on an IP packet with an initial REGISTER substring in the TCP data, and the correct intranet IP address in the subsequent Via header, without properly considering that connection progress and fragmentation affect the meaning of the packet data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: https://github.com/samyk/slipstream; https://news.ycombinator.com/item?id=24956616; https://news.ycombinator.com/item?id=24958281
CVE: CVE-2020-28042
Published: 2020-11-02
Description: ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-347
References: https://forums.servicestack.net/t/servicestack-v5-9-2-released/8850; https://github.com/ServiceStack/ServiceStack/commit/540d4060e877a03ae95343c1a8560a26768585ee; https://www.shielder.it/advisories/servicestack-jwt-signature-verification-bypass/
CVE: CVE-2020-28043
Published: 2020-11-02
Description: MISP through 2.4.133 allows SSRF in the REST client via the use_full_path parameter with an arbitrary URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/MISP/MISP/commit/6e81c8ee8ad19576c055b5c4773f914b918f32be; https://github.com/MISP/MISP/commit/6e81c8ee8ad19576c055b5c4773f914b918f32be
CVE: CVE-2020-28044
Published: 2020-11-02
Description: An attacker with physical access to a PAX Point Of Sale device with ProlinOS through 2.4.161.8859R can boot it in management mode, enable the XCB service, and then list, read, create, and overwrite files with MAINAPP permissions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-276
References: https://git.lsd.cat/g/pax-pwn; https://git.lsd.cat/g/pax-pwn
CVE: CVE-2020-28045
Published: 2020-11-02
Description: An unsigned-library issue was discovered in ProlinOS through 2.4.161.8859R. This OS requires installed applications and all system binaries to be signed either by the manufacturer or by the Point Of Sale application developer and distributor. The signature is a 2048-byte RSA signature verified in the kernel prior to ELF execution. Shared libraries, however, do not need to be signed, and they are not verified. An attacker may execute a custom binary by compiling it as a shared object and loading it via LD_PRELOAD.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347
References: https://git.lsd.cat/g/pax-pwn; https://git.lsd.cat/g/pax-pwn
CVE: CVE-2020-28046
Published: 2020-11-02
Description: An issue was discovered in ProlinOS through 2.4.161.8859R. An attacker with local code execution privileges as a normal user (MAINAPP) can escalate to root privileges by exploiting the setuid installation of the xtables-multi binary and leveraging the ip6tables --modprobe switch.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://git.lsd.cat/g/pax-pwn; https://git.lsd.cat/g/pax-pwn
CVE: CVE-2020-5652
Published: 2020-11-02
Description: Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 CPU firmware versions '20' and earlier, R 04/08/16/32/120 (EN) CPU firmware versions '52' and earlier, R 08/16/32/120 SFCPU firmware versions '22' and earlier, R 08/16/32/120 PCPU all versions, R 08/16/32/120 PSFCPU all versions, R 16/32/64 MTCPU all versions, Q03 UDECPU, Q 04/06/10/13/20/26/50/100 UDEHCPU serial number '22081' and earlier , Q 03/04/06/13/26 UDVCPU serial number '22031' and earlier, Q 04/06/13/26 UDPVCPU serial number '22031' and earlier, Q 172/173 DCPU all versions, Q 172/173 DSCPU all versions, Q 170 MCPU all versions, Q 170 MSCPU all versions, L 02/06/26 CPU (-P) and L 26 CPU - (P) BT all versions) allows a remote unauthenticated attacker to stop the Ethernet communication functions of the products via a specially crafted packet, which may lead to a denial of service (DoS) condition .
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://jvn.jp/vu/JVNVU96558207/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-013.pdf; https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-013_en.pdf