deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7006
Published: 2020-03-19
Description: Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerability could allow information disclosure, limit system availability, and may allow remote code execution.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79, CWE-79
References: https://www.us-cert.gov/ics/advisories/icsa-20-079-01; https://www.us-cert.gov/ics/advisories/icsa-20-079-01
CVE: CVE-2019-16063
Published: 2020-03-19
Description: NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data rendered within web pages. It is possible for an attacker to expose unencrypted sensitive data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16068
Published: 2020-03-19
Description: A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious manage_files.cgi request. This can be triggered via XSS or an IFRAME tag included within the site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-352
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16069
Published: 2020-03-19
Description: A number of stored Cross-site Scripting (XSS) vulnerabilities were identified in NETSAS Enigma NMS 65.0.0 and prior that could allow a threat actor to inject malicious code directly into the application through the SNMP protocol.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16529
Published: 2020-03-19
Description: An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still visible in CheckUser results in violation of MediaWiki's permissions model.
CVSS Score: 5.3 (MEDIUM)
References: https://phabricator.wikimedia.org/T207094; https://phabricator.wikimedia.org/rECHU22ddd638ba79903361df88c755232a532cbdbfb3; https://phabricator.wikimedia.org/T207094
CVE: CVE-2020-10669
Published: 2020-03-19
Description: The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated attacker able to connect to the device's web interface can get a copy of the documents uploaded by any users. NOTE: this is fixed in the latest version.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/156833/Oce-Colorwave-500-CSRF-XSS-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2020/Mar/24; https://www.redtimmy.com/red-teaming/hacking-the-oce-colorwave-printer-when-a-quick-security-assessment-determines-the-success-of-a-red-team-exercise/
CVE: CVE-2019-16071
Published: 2020-03-20
Description: Enigma NMS 65.0.0 and prior allows administrative users to create low-privileged accounts that do not have the ability to modify any settings in the system, only view the components. However, it is possible for a low-privileged user to perform all actions as an administrator by bypassing authorization controls and sending requests to the server in the context of an administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16072
Published: 2020-03-20
Description: An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.mogozobo.com/?p=3647; https://www.mogozobo.com/?p=3647
CVE: CVE-2019-16108
Published: 2020-03-20
Description: phpBB 3.2.7 allows adding an arbitrary Cascading Style Sheets (CSS) token sequence to a page through BBCode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://www.phpbb.com/community/viewtopic.php?t=2523271; https://www.phpbb.com/community/viewtopic.php?t=2523271
CVE: CVE-2018-20333
Published: 2020-03-20
Description: An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can request /update_applist.asp to see if a USB device is attached to the router and if there are apps installed on the router.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://starlabs.sg/advisories/18-20333/; https://starlabs.sg/advisories/18-20333/
CVE: CVE-2018-20334
Published: 2020-03-20
Description: An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data, there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue, an attacker can control the router and get shell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://starlabs.sg/advisories/18-20334/; https://starlabs.sg/advisories/18-20334/
CVE: CVE-2018-20335
Published: 2020-03-20
Description: An issue was discovered in ASUSWRT 3.0.0.4.384.20308. An unauthenticated user can trigger a DoS of the httpd service via the /APP_Installation.asp?= URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://starlabs.sg/advisories/18-20335/; https://starlabs.sg/advisories/18-20335/
CVE: CVE-2019-18782
Published: 2020-03-20
Description: SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.
CVSS Score: 5.3 (MEDIUM)
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_21; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_9; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_21
CVE: CVE-2019-18785
Published: 2020-03-20
Description: SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_21; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_9; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_21
CVE: CVE-2019-19023
Published: 2020-03-20
Description: Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform.
CVSS Score: 8.8 (HIGH)
References: https://github.com/goharbor/harbor/security/advisories; https://tanzu.vmware.com/security/cve-2019-19023; https://github.com/goharbor/harbor/security/advisories
CVE: CVE-2019-19025
Published: 2020-03-20
Description: Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/goharbor/harbor/security/advisories; https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6; https://tanzu.vmware.com/security/cve-2019-19025
CVE: CVE-2019-19026
Published: 2020-03-20
Description: Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://github.com/goharbor/harbor/security/advisories; https://github.com/goharbor/harbor/security/advisories/GHSA-rh89-vvrg-fg64; https://tanzu.vmware.com/security/cve-2019-19026
CVE: CVE-2019-19029
Published: 2020-03-20
Description: Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/goharbor/harbor/security/advisories; https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w; https://tanzu.vmware.com/security/cve-2019-19029
CVE: CVE-2019-19484
Published: 2020-03-20
Description: Open redirect via parameter ‘p’ in login.php in Centreon (19.04.4 and below) allows an attacker to craft a payload and execute unintended behavior.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://medium.com/%40mucomplex/undisclosed-cve-2019-19484-cve-2019-19486-cve-2019-19487-b46b97c930cd; https://medium.com/%40mucomplex/undisclosed-cve-2019-19484-cve-2019-19486-cve-2019-19487-b46b97c930cd
CVE: CVE-2019-19486
Published: 2020-03-20
Description: Local File Inclusion in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to traverse paths via a plugin test.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://medium.com/%40mucomplex/undisclosed-cve-2019-19484-cve-2019-19486-cve-2019-19487-b46b97c930cd; https://medium.com/%40mucomplex/undisclosed-cve-2019-19484-cve-2019-19486-cve-2019-19487-b46b97c930cd
CVE: CVE-2019-19487
Published: 2020-03-20
Description: Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://medium.com/%40mucomplex/undisclosed-cve-2019-19484-cve-2019-19486-cve-2019-19487-b46b97c930cd; https://medium.com/%40mucomplex/undisclosed-cve-2019-19484-cve-2019-19486-cve-2019-19487-b46b97c930cd
CVE: CVE-2020-9343
Published: 2020-03-20
Description: An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service attack because the implementation doesn't limit the parsing of nested JSON structures. If a victim visits an attacker-controlled website, this vulnerability can be exploited via WebSocket data with a deeply nested JSON array.
CVSS Score: 6.5 (MEDIUM)
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-053.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-053.txt
CVE: CVE-2020-9344
Published: 2020-03-20
Description: Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kintosoft.atlassian.net/wiki/spaces/SVNALM/pages/753565697/Security+Bulletin; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-007.txt; https://kintosoft.atlassian.net/wiki/spaces/SVNALM/pages/753565697/Security+Bulletin
CVE: CVE-2020-9345
Published: 2020-03-20
Description: An issue was discovered in signotec signoPAD-API/Web (formerly Websocket Pad Server) before 3.1.1 on Windows. It is possible to perform a Denial of Service attack because the application doesn't limit the number of opened WebSocket sockets. If a victim visits an attacker-controlled website, this vulnerability can be exploited.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-052.txt; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-052.txt
CVE: CVE-2020-10681
Published: 2020-03-20
Description: The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1_files[] to admin/moduleinterface.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://dev.cmsmadesimple.org/bug/view/12274; http://dev.cmsmadesimple.org/bug/view/12274
CVE: CVE-2020-10682
Published: 2020-03-20
Description: The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: http://dev.cmsmadesimple.org/bug/view/12275; http://dev.cmsmadesimple.org/bug/view/12275
CVE: CVE-2019-10179
Published: 2020-03-20
Description: A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10179; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10179
CVE: CVE-2019-10221
Published: 2020-03-20
Description: A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10221; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10221
CVE: CVE-2019-19345
Published: 2020-03-20
Description: A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mediawiki-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-269
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19345; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19345
CVE: CVE-2020-10597
Published: 2020-03-20
Description: Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read information and/or crash the application.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125, CWE-125
References: https://www.us-cert.gov/ics/advisories/icsa-20-182-01; https://www.us-cert.gov/ics/advisories/icsa-20-182-01
CVE: CVE-2020-1696
Published: 2020-03-20
Description: A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1696; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1696
CVE: CVE-2020-1707
Published: 2020-03-20
Description: A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/postgresql-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1707; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1707
CVE: CVE-2020-1709
Published: 2020-03-20
Description: A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732, CWE-732
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1709; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1709
CVE: CVE-2020-1793
Published: 2020-03-20
Description: There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, successful exploit could allow the attacker to gain certain data of the application which is locked. Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-02-smartphone-en
CVE: CVE-2020-1794
Published: 2020-03-20
Description: There is an improper authentication vulnerability in several smartphones. The applock does not perform a sufficient authentication in certain scenarios, successful exploit could allow the attacker to gain certain data of the application which is locked. Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-02-smartphone-en
CVE: CVE-2020-1795
Published: 2020-03-20
Description: There is a logic error vulnerability in several smartphones. The software does not properly restrict certain operation when the Digital Balance function is on. Successful exploit could allow the attacker to bypass the Digital Balance limit after a series of operations.Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
CVSS Score: 2.4 (LOW)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-04-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-04-smartphone-en
CVE: CVE-2020-1796
Published: 2020-03-20
Description: There is an improper authorization vulnerability in several smartphones. The software incorrectly performs an authorization to certain user, successful exploit could allow a low privilege user to do certain operation which the user are supposed not to do.Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-863
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-05-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-05-smartphone-en
CVE: CVE-2020-1862
Published: 2020-03-20
Description: There is a double free vulnerability in some Huawei products. A local attacker with low privilege may perform some operations to exploit the vulnerability. Due to doubly freeing memory, successful exploit may cause some service abnormal. Affected product versions include:CampusInsight versions V100R019C00;ManageOne versions 6.5.RC2.B050.
CVSS Score: 3.3 (LOW)
CWE: CWE-415
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-01-free-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-01-free-en
CVE: CVE-2020-1864
Published: 2020-03-20
Description: Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device to send specific packets to the affected device. Due to the improper implementation of the authentication function, attackers can exploit the vulnerability to connect to affected devices and execute a series of commands.Affected product versions include:Secospace AntiDDoS8000 versions V500R001C00,V500R001C20,V500R001C60,V500R005C00.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-01-authentication-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200318-01-authentication-en
CVE: CVE-2020-1878
Published: 2020-03-20
Description: Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200311-01-informationleak-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-dos-en
CVE: CVE-2019-14855
Published: 2020-03-20
Description: A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-326
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855; https://dev.gnupg.org/T4755; https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html
CVE: CVE-2020-1879
Published: 2020-03-20
Description: There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has an improper integrity check which may allow an attacker with high privilege to make malicious modifications.Affected product versions include:HEGE-560 versions 1.0.1.21(SP3);HEGE-570 versions 1.0.1.22(SP3);OSCA-550 versions 1.0.1.21(SP3);OSCA-550A versions 1.0.1.21(SP3);OSCA-550AX versions 1.0.1.21(SP3);OSCA-550X versions 1.0.1.21(SP3).
CVSS Score: 3.9 (LOW)
CWE: CWE-354
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200311-01-integrity-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-dos-en
CVE: CVE-2019-15661
Published: 2020-03-20
Description: An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120004 in KfeCo10X64.sys fails to validate parameters, leading to a stack-based buffer overflow, which can lead to code execution or escalation of privileges.
CVSS Score: 7.2 (HIGH)
CWE: CWE-787
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0005/FEYE-2019-0005.md; https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf; https://www.killernetworking.com
CVE: CVE-2019-15075
Published: 2020-03-20
Description: An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-798
References: https://github.com/iNextrix/ASTPP/commit/9877ec62556f0470030acd306b24bc94fdcbe2ae; https://github.com/iNextrix/ASTPP/commit/9877ec62556f0470030acd306b24bc94fdcbe2ae
CVE: CVE-2019-15662
Published: 2020-03-20
Description: An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120444 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an arbitrary read primitive that can be used as part of a chain to escalate privileges.
CVSS Score: 2.7 (LOW)
CWE: CWE-125
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0006/FEYE-2019-0006.md; https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf; https://www.killernetworking.com
CVE: CVE-2019-15663
Published: 2020-03-20
Description: An issue was discovered in Rivet Killer Control Center before 2.1.1352. IOCTL 0x120404 in KfeCo10X64.sys fails to validate an offset passed as a parameter during a memory operation, leading to an out-of-bounds read that can be used as part of a chain to escalate privileges (issue 1 of 2).
CVSS Score: 2.7 (LOW)
CWE: CWE-125
References: https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2019-0007/FEYE-2019-0007.md; https://support.killernetworking.com/downloads/ReleaseNotes/KillerSoftware_Release_Notes_2.1.1352.pdf; https://www.killernetworking.com