deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12043
Published: 2020-06-29
Description: The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is rebooted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-672, CWE-672
References: https://www.us-cert.gov/ics/advisories/icsma-20-170-04; https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE: CVE-2020-12045
Published: 2020-06-29
Description: The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when used in conjunction with a Baxter Spectrum v8.x (model 35700BAX2), operates a Telnet service on Port 1023 with hard-coded credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsma-20-170-04; https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE: CVE-2020-12047
Published: 2020-06-29
Description: The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-default wireless configuration enables an FTP service with hard-coded credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsma-20-170-04; https://www.us-cert.gov/ics/advisories/icsma-20-170-04
CVE: CVE-2020-12048
Published: 2020-06-29
Description: Phoenix Hemodialysis Delivery System SW 3.36 and 3.40, The Phoenix Hemodialysis device does not support data-in-transit encryption (e.g., TLS/SSL) when transmitting treatment and prescription data on the network between the Phoenix system and the Exalis dialysis data management tool. An attacker with access to the network could observe sensitive treatment and prescription data sent between the Phoenix system and the Exalis tool.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-319
References: https://www.us-cert.gov/ics/advisories/icsma-20-170-03; https://www.us-cert.gov/ics/advisories/icsma-20-170-03
CVE: CVE-2020-12635
Published: 2020-06-29
Description: XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://anothernetsecblog.com/magento-2-extension-security/; https://mageme.com/magento-2-form-builder.html; https://anothernetsecblog.com/magento-2-extension-security/
CVE: CVE-2020-13423
Published: 2020-06-29
Description: Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Current_url or email field, or the User-Agent HTTP header.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://anothernetsecblog.com; https://anothernetsecblog.com/magento-2-extension-security/; https://landofcoder.com/magento-2-form-builder.html
CVE: CVE-2020-4452
Published: 2020-06-29
Description: IBM API Connect V2018.4.1.0 through 2018.4.1.11 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 181324.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181324; https://www.ibm.com/support/pages/node/6240322; https://exchange.xforce.ibmcloud.com/vulnerabilities/181324
CVE: CVE-2020-4557
Published: 2020-06-29
Description: IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183611.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183611; https://www.ibm.com/support/pages/node/6241338; https://exchange.xforce.ibmcloud.com/vulnerabilities/183611
CVE: CVE-2020-8573
Published: 2020-06-29
Description: The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-798
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-15312
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15313
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15314
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-2021
Published: 2020-06-29
Description: When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based attacker to access protected resources. The attacker must have network access to the vulnerable server to exploit this vulnerability. This issue affects PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15, and all versions of PAN-OS 8.0 (EOL). This issue does not affect PAN-OS 7.1. This issue cannot be exploited if SAML is not used for authentication. This issue cannot be exploited if the 'Validate Identity Provider Certificate' option is enabled (checked) in the SAML Identity Provider Server Profile. Resources that can be protected by SAML-based single sign-on (SSO) authentication are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN, Authentication and Captive Portal, PAN-OS next-generation firewalls (PA-Series, VM-Series) and Panorama web interfaces, Prisma Access In the case of GlobalProtect Gateways, GlobalProtect Portal, Clientless VPN, Captive Portal, and Prisma Access, an unauthenticated attacker with network access to the affected servers can gain access to protected resources if allowed by configured authentication and Security policies. There is no impact on the integrity and availability of the gateway, portal or VPN server. An attacker cannot inspect or tamper with sessions of regular users. In the worst case, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N). In the case of PAN-OS and Panorama web interfaces, this issue allows an unauthenticated attacker with network access to the PAN-OS or Panorama web interfaces to log in as an administrator and perform administrative actions. In the worst-case scenario, this is a critical severity vulnerability with a CVSS Base Score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). If the web interfaces are only accessible to a restricted management network, then the issue is lowered to a CVSS Base Score of 9.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Palo Alto Networks is not aware of any malicious attempts to exploit this vulnerability.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-347, CWE-347
References: https://security.paloaltonetworks.com/CVE-2020-2021; https://security.paloaltonetworks.com/CVE-2020-2021; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2021
CVE: CVE-2020-15315
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/axess chroot directory tree.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15316
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded ECDSA SSH key for the root account within the /opt/axess chroot directory tree.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15317
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/axess chroot directory tree.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15318
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded DSA SSH key for the root account within the /opt/mysql chroot directory tree.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15319
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded RSA SSH key for the root account within the /opt/mysql chroot directory tree.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15320
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axiros password for the root account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15321
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the axzyxel password for the livedbuser account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15322
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the wbboEZ4BN3ssxAfM hardcoded password for the debian-sys-maint account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15323
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has the cloud1234 password for the a1@chopin account default credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-15324
Published: 2020-06-29
Description: Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a world-readable axess/opt/axXMPPHandler/config/xmpp_config.py file that stores hardcoded credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html; https://www.zyxel.com/support/vulnerabilities-of-CloudCNM-SecuManager.shtml; https://pierrekim.github.io/blog/2020-03-09-zyxel-secumanager-0day-vulnerabilities.html
CVE: CVE-2020-14068
Published: 2020-06-29
Description: An issue was discovered in MK-AUTH 19.01. The web login functionality allows an attacker to bypass authentication and gain client privileges via SQL injection in central/executar_login.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://mk-auth.com.br/page/changelog-1; https://gist.github.com/merhawi023/a1155913df3cf0c17971b0fb7dcd8f20; http://mk-auth.com.br/page/changelog-1
CVE: CVE-2020-14069
Published: 2020-06-29
Description: An issue was discovered in MK-AUTH 19.01. There are SQL injection issues in mkt/ PHP scripts, as demonstrated by arp.php, dhcp.php, hotspot.php, ip.php, pgaviso.php, pgcorte.php, pppoe.php, queues.php, and wifi.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://mk-auth.com.br/page/changelog-1; https://gist.github.com/merhawi023/a1155913df3cf0c17971b0fb7dcd8f20; http://mk-auth.com.br/page/changelog-1
CVE: CVE-2020-14070
Published: 2020-06-29
Description: An issue was discovered in MK-AUTH 19.01. There is authentication bypass in the web login functionality because guessable credentials to admin/executar_login.php result in admin access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://mk-auth.com.br/page/changelog-1; https://gist.github.com/merhawi023/a1155913df3cf0c17971b0fb7dcd8f20; http://mk-auth.com.br/page/changelog-1
CVE: CVE-2020-14071
Published: 2020-06-29
Description: An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://mk-auth.com.br/page/changelog-1; https://gist.github.com/merhawi023/a1155913df3cf0c17971b0fb7dcd8f20; http://mk-auth.com.br/page/changelog-1
CVE: CVE-2020-14072
Published: 2020-06-29
Description: An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://mk-auth.com.br/page/changelog-1; https://gist.github.com/merhawi023/a1155913df3cf0c17971b0fb7dcd8f20; http://mk-auth.com.br/page/changelog-1
CVE: CVE-2020-14412
Published: 2020-06-29
Description: NeDi 1.9C is vulnerable to Remote Command Execution. System-Snapshot.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a psw parameter. (This can also be exploited via CSRF.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/farid007/c0df57620a3cc1fb565bc77a945aa3fd; https://gist.github.com/farid007/c0df57620a3cc1fb565bc77a945aa3fd
CVE: CVE-2020-14413
Published: 2020-06-29
Description: NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/farid007/8db2ab5367ba00e87f9479b32d46fea8; https://gist.github.com/farid007/8db2ab5367ba00e87f9479b32d46fea8
CVE: CVE-2020-14414
Published: 2020-06-29
Description: NeDi 1.9C is vulnerable to Remote Command Execution. pwsec.php improperly escapes shell metacharacters from a POST request. An attacker can exploit this by crafting an arbitrary payload (any system commands) that contains shell metacharacters via a POST request with a pw parameter. (This can also be exploited via CSRF.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://gist.github.com/farid007/a3d96d305f028d221f729eb6ae681f5a; https://gist.github.com/farid007/a3d96d305f028d221f729eb6ae681f5a
CVE: CVE-2020-15354
Published: 2020-06-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-15355
Published: 2020-06-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-15356
Published: 2020-06-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-15362
Published: 2020-06-29
Description: wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/thingsSDK/wifiscanner/issues/1; https://github.com/thingsSDK/wifiscanner/issues/1
CVE: CVE-2018-6446
Published: 2020-06-29
Description: A vulnerability in Brocade Network Advisor Version Before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-841; https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2018-841
CVE: CVE-2020-13657
Published: 2020-06-29
Description: An elevation of privilege vulnerability exists in Avast Free Antivirus and AVG AntiVirus Free before 20.4 due to improperly handling hard links. The vulnerability allows local users to take control of arbitrary files.
CVSS Score: 5.5 (MEDIUM)
References: https://forum.avast.com/index.php?topic=232423.0; https://forum.avast.com/index.php?topic=234638.0; https://forum.avast.com/index.php?topic=232423.0
CVE: CVE-2020-13896
Published: 2020-06-29
Description: The web interface of Maipu MP1800X-50 7.5.3.14(R) devices allows remote attackers to obtain sensitive information via the form/formDeviceVerGet URI, such as system id, hardware model, hardware version, bootloader version, software version, software image file, compilation time, and system uptime. This is similar to CVE-2019-1653.
CVSS Score: 5.3 (MEDIUM)
References: https://gist.github.com/Saket-taneja/[PII_REDACTED]be1cb0d6dc9d9a73db5631; https://gist.github.com/Saket-taneja/[PII_REDACTED]be1cb0d6dc9d9a73db5631
CVE: CVE-2020-14002
Published: 2020-06-29
Description: PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203
References: https://lists.debian.org/debian-lts-announce/2024/04/msg00016.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26TACCSQYYCPWAJYNAUIXJGZ5RGORJZV/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JPV4A77EDCT4BTFO5BE26ZH72BG4E5IJ/
CVE: CVE-2020-14145
Published: 2020-06-29
Description: The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-203, CWE-203
References: http://www.openwall.com/lists/oss-security/2020/12/02/1; https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d; https://docs.ssh-mitm.at/CVE-2020-14145.html
CVE: CVE-2020-15043
Published: 2020-06-29
Description: iBall WRB303N devices allow CSRF attacks, as demonstrated by enabling remote management, enabling DHCP, or modifying the subnet range for IP addresses.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://gist.github.com/Saket-taneja/4dda4b2df5aa0973a7160bb6bf8875e0; https://github.com/Saket-taneja/IballCSRFExploit; https://gist.github.com/Saket-taneja/4dda4b2df5aa0973a7160bb6bf8875e0
CVE: CVE-2020-15069
Published: 2020-06-29
Description: Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120, CWE-120
References: https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal; https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15069
CVE: CVE-2020-4037
Published: 2020-06-29
Description: In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. This has been fixed in version 6.0.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-601
References: https://github.com/oauth2-proxy/oauth2-proxy/commit/ee5662e0f5001d76ec76562bb605abbd07c266a2; https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv; https://github.com/oauth2-proxy/oauth2-proxy/commit/ee5662e0f5001d76ec76562bb605abbd07c266a2
CVE: CVE-2020-4067
Published: 2020-06-29
Description: In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
CVSS Score: 7.0 (HIGH)
CWE: CWE-665, CWE-665
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html; https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15; https://github.com/coturn/coturn/issues/583
CVE: CVE-2020-15368
Published: 2020-06-29
Description: AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.
CVSS Score: 5.5 (MEDIUM)
References: https://codetector.org/post/asrock_rgb_driver/; https://github.com/stong/CVE-2020-15368?tab=readme-ov-file; https://codetector.org/post/asrock_rgb_driver/