deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-4694
Published: 2020-08-26
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171832.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171832; https://www.ibm.com/support/pages/node/6320835; https://exchange.xforce.ibmcloud.com/vulnerabilities/171832
CVE: CVE-2019-4697
Published: 2020-08-26
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 171938.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171928; https://www.ibm.com/support/pages/node/6320835; https://exchange.xforce.ibmcloud.com/vulnerabilities/171928
CVE: CVE-2019-4698
Published: 2020-08-26
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 171929.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171929; https://www.ibm.com/support/pages/node/6320817; https://exchange.xforce.ibmcloud.com/vulnerabilities/171929
CVE: CVE-2019-4699
Published: 2020-08-26
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 171931.
CVSS Score: 2.7 (LOW)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171931; https://www.ibm.com/support/pages/node/6320835; https://exchange.xforce.ibmcloud.com/vulnerabilities/171931
CVE: CVE-2019-4701
Published: 2020-08-26
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 is deployed with active debugging code that can create unintended entry points. IBM X-Force ID: 171936.
CVSS Score: 5.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171936; https://www.ibm.com/support/pages/node/6320817; https://exchange.xforce.ibmcloud.com/vulnerabilities/171936
CVE: CVE-2019-4713
Published: 2020-08-26
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 172084.
CVSS Score: 8.8 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172084; https://www.ibm.com/support/pages/node/6320817; https://exchange.xforce.ibmcloud.com/vulnerabilities/172084
CVE: CVE-2020-11497
Published: 2020-08-26
Description: An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. An online payment system bypass allows orders to be marked as fully paid by assigning an arbitrary bank transaction ID during the payment-details entry step.
CVSS Score: 7.5 (HIGH)
CWE: CWE-354
References: http://packetstormsecurity.com/files/158931/WordPress-NAB-Transact-WooCommerce-2.1.0-Payment-Bypass.html; http://seclists.org/fulldisclosure/2020/Aug/13; http://seclists.org/fulldisclosure/2020/Aug/13
CVE: CVE-2020-11797
Published: 2020-08-26
Description: An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an unauthenticated attacker to gain access to unauthorized information due to insufficient access validation. A successful exploit could allow an attacker to access sensitive shared files.
CVSS Score: 7.5 (HIGH)
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005; https://www.mitel.com/support/security-advisories
CVE: CVE-2020-12456
Published: 2020-08-26
Description: A remote code execution vulnerability in Mitel MiVoice Connect Client before[PII_REDACTED].0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform directory traversal, and execute arbitrary scripts in the context of the Connect client.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0006; https://www.mitel.com/support/security-advisories
CVE: CVE-2020-12855
Published: 2020-08-26
Description: A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an adversary controlling the execution flow for the 302 HTTP status.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: http://packetstormsecurity.com/files/158965/SecZetta-NEProfile-3.3.11-Host-Header-Injection.html; http://packetstormsecurity.com/files/158965/SecZetta-NEProfile-3.3.11-Host-Header-Injection.html
CVE: CVE-2020-15156
Published: 2020-08-26
Description: In nodebb-plugin-blog-comments before version 0.7.0, a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618; https://github.com/psychobunny/nodebb-plugin-blog-comments/security/advisories/GHSA-43m5-c88r-cjvv; https://www.npmjs.com/package/nodebb-plugin-blog-comments
CVE: CVE-2020-17376
Published: 2020-08-26
Description: An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.
CVSS Score: 8.3 (HIGH)
CWE: CWE-611
References: http://www.openwall.com/lists/oss-security/2020/08/25/4; https://launchpad.net/bugs/1890501; https://security.openstack.org/ossa/OSSA-2020-006.html
CVE: CVE-2020-24548
Published: 2020-08-26
Description: Ericom Access Server 9.2.0 (for AccessNow and Ericom Blaze) allows SSRF to make outbound WebSocket connection requests on arbitrary TCP ports, and provides "Cannot connect to" error messages to inform the attacker about closed ports.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/158962/Ericom-Access-Server-9.2.0-Server-Side-Request-Forgery.html; https://www.youtube.com/watch?v=oDTd-yRxVJ0; http://packetstormsecurity.com/files/158962/Ericom-Access-Server-9.2.0-Server-Side-Request-Forgery.html
CVE: CVE-2019-4695
Published: 2020-08-26
Description: IBM Security Guardium Data Encryption (GDE) 3.0.0.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 171926.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171926; https://www.ibm.com/support/pages/node/6320817; https://exchange.xforce.ibmcloud.com/vulnerabilities/171926
CVE: CVE-2020-15485
Published: 2020-08-26
Description: An issue was discovered on Nescomed Multipara Monitor M1000 devices. The onboard Flash memory stores data in cleartext, without integrity protection against tampering.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://payatu.com/advisory/lack-of-medical-data-encryption-in-dr-trust-ecg-or-ekg-pen; https://www.niscomed.com/multipara-monitor.html; https://payatu.com/advisory/lack-of-medical-data-encryption-in-dr-trust-ecg-or-ekg-pen
CVE: CVE-2020-24598
Published: 2020-08-26
Description: An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of com_content leads to an open redirect.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-open-redirect-in-com-content-vote-feature; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-open-redirect-in-com-content-vote-feature
CVE: CVE-2020-24599
Published: 2020-08-26
Description: An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-xss-in-mod-latestactions; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-xss-in-mod-latestactions
CVE: CVE-2019-5320
Published: 2020-08-26
Description: Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10.* before 16.10.0003 are vulnerable to Cross Site Scripting in the web UI, leading to injection of code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-007.txt
CVE: CVE-2019-5321
Published: 2020-08-26
Description: Aruba Intelligent Edge Switch Series 2540, 2530, 2930F, 2930M, 2920, 5400R, and 3810M with firmware 16.08.* before 16.08.0009, 16.09.* before 16.09.0007, 16.10.* before 16.10.0003 are vulnerable to Remote Unauthorized Access in the WebUI.
CVSS Score: 8.8 (HIGH)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-007.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-007.txt
CVE: CVE-2020-14728
Published: 2020-08-27
Description: Vulnerability in the SuiteCommerce Advanced (SCA) component of Oracle NetSuite service. Supported versions that are affected are Montblanc, Vinson, Elbrus, Kilimanjaro, Aconcagua, 2018.2, 2019.1, 2019.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise NetSuite SCA. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in NetSuite SCA, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of NetSuite SCA accessible data as well as unauthorized read access to a subset of NetSuite SCA data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://system.netsuite.com/app/help/helpcenter.nl; https://system.netsuite.com/app/help/helpcenter.nl
CVE: CVE-2020-14729
Published: 2020-08-27
Description: Vulnerability in SuiteCommerce Advanced (SCA) Sites component of Oracle NetSuite service. Supported versions that are affected are prior to 2020.1.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise NetSuite SCA. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all NetSuite SCA accessible data as well as unauthorized read access to a subset of NetSuite SCA data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:N).
CVSS Score: 5.4 (MEDIUM)
References: https://system.netsuite.com/app/help/helpcenter.nl; https://system.netsuite.com/app/help/helpcenter.nl
CVE: CVE-2020-23980
Published: 2020-08-27
Description: DesignMasterEvents Conference management 1.0.0 allows SQL Injection via the username field on the administrator login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/156959/DesignMasterEvents-CMS-1.0-SQL-Injection-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-4166
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 174402.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174402; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/174402
CVE: CVE-2020-4167
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 could allow an attacker to obtain sensitive information or perform unauthorized actions due to improper authenciation mechanisms. IBM X-Force ID: 174403.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174403; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/174403
CVE: CVE-2020-4169
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174405.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174405; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/174405
CVE: CVE-2020-4171
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 174407.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174407; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/174407
CVE: CVE-2020-4172
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 174408.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174408; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/174408
CVE: CVE-2020-4174
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174683.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174683; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/174683
CVE: CVE-2020-4175
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 174684.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-862
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174684; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/174684
CVE: CVE-2020-4575
Published: 2020-08-27
Description: IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184363; https://www.ibm.com/support/pages/node/6323293; https://exchange.xforce.ibmcloud.com/vulnerabilities/184363
CVE: CVE-2020-4603
Published: 2020-08-27
Description: IBM Security Guardium Insights 2.0.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. IBM X-Force ID: 184880.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184880; https://www.ibm.com/support/pages/node/6323297; https://exchange.xforce.ibmcloud.com/vulnerabilities/184880
CVE: CVE-2020-23972
Published: 2020-08-27
Description: In Joomla Component GMapFP Version J3.5 and J3.5free, an attacker can access the upload function without authenticating to the application and can also upload files which due to issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/159072/Joomla-GMapFP-J3.5-J3.5F-Arbitrary-File-Upload.html; https://raw.githubusercontent.com/me4yoursecurity/Reports/master/README.md; http://packetstormsecurity.com/files/159072/Joomla-GMapFP-J3.5-J3.5F-Arbitrary-File-Upload.html
CVE: CVE-2020-23973
Published: 2020-08-27
Description: KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/157049/KandNconcepts-Club-CMS-1.1-1.2-Cross-Site-Scripting-SQL-Injection.html; https://packetstormsecurity.com/files/157049/KandNconcepts-Club-CMS-1.1-1.2-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2020-23974
Published: 2020-08-27
Description: Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/157599/Create-Project-Manager-1.07-Cross-Site-Scripting-HTML-Injection.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-23975
Published: 2020-08-27
Description: Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/156948/Webexcels-Ecommerce-CMS-2.x-SQL-Injection-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-23976
Published: 2020-08-27
Description: Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has SQL Injection via the 'content.php' id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/156948/Webexcels-Ecommerce-CMS-2.x-SQL-Injection-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-23977
Published: 2020-08-27
Description: KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/157049/KandNconcepts-Club-CMS-1.1-1.2-Cross-Site-Scripting-SQL-Injection.html; https://packetstormsecurity.com/files/157049/KandNconcepts-Club-CMS-1.1-1.2-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2020-23978
Published: 2020-08-27
Description: SQL injection can occur in Soluzione Globale Ecommerce CMS v1 via the parameter " offerta.php"
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/156939/Soluzione-Globale-Ecommerce-CMS-1-SQL-Injection.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-23979
Published: 2020-08-27
Description: 13enforme CMS 1.0 has SQL Injection via the 'content.php' id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://packetstormsecurity.com/files/157094/13enforme-CMS-SQL-Injection-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/157094/13enforme-CMS-SQL-Injection-Cross-Site-Scripting.html
CVE: CVE-2020-23981
Published: 2020-08-27
Description: 13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/157094/13enforme-CMS-SQL-Injection-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/157094/13enforme-CMS-SQL-Injection-Cross-Site-Scripting.html
CVE: CVE-2020-23982
Published: 2020-08-27
Description: DesignMasterEvents Conference management 1.0.0 has cross site scripting via the 'certificate.php'
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/156959/DesignMasterEvents-CMS-1.0-SQL-Injection-Cross-Site-Scripting.html; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-23983
Published: 2020-08-27
Description: Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/157594/iChat-1.6-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/157594/iChat-1.6-Cross-Site-Scripting.html
CVE: CVE-2020-23984
Published: 2020-08-27
Description: Online Hotel Booking System Pro PHP Version 1.3 has Persistent Cross-site Scripting in Customer registration-form all-tags.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://packetstormsecurity.com/files/157117/Online-Hotel-Booking-System-Pro-1.3-Cross-Site-Scripting.html; https://packetstormsecurity.com/files/157117/Online-Hotel-Booking-System-Pro-1.3-Cross-Site-Scripting.html
CVE: CVE-2020-14415
Published: 2020-08-27
Description: oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
CVSS Score: 3.3 (LOW)
CWE: CWE-369
References: https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7a4ede0047a8613b0e3b72c9d351038f013dd357; https://usn.ubuntu.com/4467-1/; https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=7a4ede0047a8613b0e3b72c9d351038f013dd357
CVE: CVE-2020-16142
Published: 2020-08-27
Description: On Mercedes-Benz C Class AMG Premium Plus c220 BlueTec vehicles, the Bluetooth stack mishandles %x and %c format-string specifiers in a device name in the COMAND infotainment software.
CVSS Score: 3.5 (LOW)
CWE: CWE-134
References: https://medium.com/%40reliable_lait_mouse_975/mercedes-comand-infotainment-improper-format-strings-handling-4c67063d744e; https://medium.com/%40reliable_lait_mouse_975/mercedes-comand-infotainment-improper-format-strings-handling-4c67063d744e
CVE: CVE-2020-23576
Published: 2020-08-27
Description: Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://vimeo.com/427083932; https://vimeo.com/427083932
CVE: CVE-2020-24390
Published: 2020-08-27
Description: eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page, which might allow pre-authentication stored XSS during login/logout logs recording.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/EyesOfNetworkCommunity/eonweb/commit/c416b52d3b500d96ab40875f95b7c[PII_REDACTED]b; https://github.com/EyesOfNetworkCommunity/eonweb/releases/tag/5.3-7; https://www.eyesofnetwork.com/fr/news/fr-CVE-2020-24390