deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5385
Published: 2020-08-18
Description: Dell Encryption versions prior to 10.8 and Dell Endpoint Security Suite versions prior to 2.8 contain a privilege escalation vulnerability because of an incomplete fix for CVE-2020-5358. A local malicious user with low privileges could potentially exploit this vulnerability to gain elevated privilege on the affected system with the help of a symbolic link.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732, CWE-732
References: https://www.dell.com/support/article/SLN322456; https://www.dell.com/support/article/SLN322456
CVE: CVE-2020-24381
Published: 2020-08-19
Description: GUnet Open eClass Platform (aka openeclass) before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://emaragkos.gr/cve-2020-24381/; https://github.com/gunet/openeclass/issues/39; https://emaragkos.gr/cve-2020-24381/
CVE: CVE-2020-24394
Published: 2020-08-19
Description: In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
CVE: CVE-2020-4381
Published: 2020-08-19
Description: IBM Spectrum Scale for IBM Elastic Storage Server 5.3.0 through 5.3.6 could allow an authenticated user to cause a denial of service during deployment or upgrade if GUI specific services are enabled. IBM X-Force ID: 179162.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179162; https://www.ibm.com/support/pages/node/6261435; https://exchange.xforce.ibmcloud.com/vulnerabilities/179162
CVE: CVE-2020-4648
Published: 2020-08-19
Description: A vulnerability exsists in IBM Planning Analytics 2.0 whereby avatars in Planning Analytics Workspace could be modified by other users without authorization to do so. IBM X-Force ID: 186019.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186019; https://www.ibm.com/support/pages/node/6254788; https://exchange.xforce.ibmcloud.com/vulnerabilities/186019
CVE: CVE-2020-4653
Published: 2020-08-19
Description: IBM Planning Analytics 2.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186082; https://www.ibm.com/support/pages/node/6254788; https://exchange.xforce.ibmcloud.com/vulnerabilities/186082
CVE: CVE-2020-9698
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9699
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9700
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9701
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9693
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://www.zerodayinitiative.com/advisories/ZDI-20-982/; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9694
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://www.zerodayinitiative.com/advisories/ZDI-20-983/; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9696
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass.
CVSS Score: 5.5 (MEDIUM)
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9697
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a disclosure of sensitive data vulnerability. Successful exploitation could lead to memory leak.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9702
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to application denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9703
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a stack exhaustion vulnerability. Successful exploitation could lead to application denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9704
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a buffer error vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9705
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9706
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://www.zerodayinitiative.com/advisories/ZDI-20-988/; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9707
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://www.zerodayinitiative.com/advisories/ZDI-20-987/; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9710
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://www.zerodayinitiative.com/advisories/ZDI-20-989/; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9712
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a security bypass vulnerability. Successful exploitation could lead to security feature bypass.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://www.zerodayinitiative.com/advisories/ZDI-20-990/; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9714
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have a security bypass vulnerability. Successful exploitation could lead to privilege escalation .
CVSS Score: 7.8 (HIGH)
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9715
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://blog.exodusintel.com/2021/04/20/analysis-of-a-use-after-free-vulnerability-in-adobe-acrobat-reader-dc/; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://www.zerodayinitiative.com/advisories/ZDI-20-991/
CVE: CVE-2020-11848
Published: 2020-08-19
Description: Denial of service vulnerability on Micro Focus ArcSight Management Center. Affecting all versions prior to version 2.9.5. The vulnerability could cause the server to become unavailable, causing a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://community.microfocus.com/t5/ArcSight-Management-Center-ArcMC/ArcSight-Management-Center-2-9-5-Release-Notes/ta-p/2814648; https://community.microfocus.com/t5/ArcSight-Management-Center-ArcMC/ArcSight-Management-Center-2-9-5-Release-Notes/ta-p/2814648
CVE: CVE-2020-14356
Published: 2020-08-19
Description: A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html; https://bugzilla.kernel.org/show_bug.cgi?id=208003
CVE: CVE-2020-24368
Published: 2020-08-19
Description: Icinga Icinga Web2 2.0.0 through 2.6.4, 2.7.4 and 2.8.2 has a Directory Traversal vulnerability which allows an attacker to access arbitrary files that are readable by the process running Icinga Web 2. This issue is fixed in Icinga Web 2 in v2.6.4, v2.7.4 and v2.8.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00026.html; https://github.com/Icinga/icingaweb2/blob/master/CHANGELOG.md; https://github.com/Icinga/icingaweb2/issues/4226
CVE: CVE-2020-9716
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9717
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9718
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9719
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9720
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9721
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9722
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9723
Published: 2020-08-19
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]4 and earlier, 2[PII_REDACTED]2, 2[PII_REDACTED]1 and earlier, and 2[PII_REDACTED]3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-48.html; https://helpx.adobe.com/security/products/acrobat/apsb20-48.html
CVE: CVE-2020-9724
Published: 2020-08-19
Description: Adobe Lightroom versions 9.2.0.10 and earlier have an insecure library loading vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpx.adobe.com/security/products/lightroom/apsb20-51.html; https://helpx.adobe.com/security/products/lightroom/apsb20-51.html
CVE: CVE-2020-23574
Published: 2020-08-19
Description: When uploading a file in Sysax Multi Server 6.90, an authenticated user can modify the filename="" parameter in the uploadfile_name1.htm form to a length of 368 or more bytes. This will create a buffer overflow condition, causing the application to crash.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://www.hosaka.co.uk/2020/06/08/sysax-multi-server-buffer-overflow/; https://www.hosaka.co.uk/2020/06/08/sysax-multi-server-buffer-overflow/
CVE: CVE-2020-13825
Published: 2020-08-20
Description: A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-005; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-005
CVE: CVE-2020-13826
Published: 2020-08-20
Description: A CSV injection (aka Excel Macro Injection or Formula Injection) issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236
References: https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-006; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-006
CVE: CVE-2020-15119
Published: 2020-08-20
Description: In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xc; https://github.com/auth0/lock/security/advisories/GHSA-6gg3-pmm7-97xc
CVE: CVE-2020-15143
Published: 2020-08-20
Description: In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
CVSS Score: 7.7 (HIGH)
CWE: CWE-74, CWE-917
References: https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv; https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv
CVE: CVE-2020-15146
Published: 2020-08-20
Description: In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-74, CWE-917
References: https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5; https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5
CVE: CVE-2020-15149
Published: 2020-08-20
Description: NodeBB before version 1.14.3 has a bug introduced in version 1.12.2 in the validation logic that makes it possible to change the password of any user on a running NodeBB forum by sending a specially crafted socket.io call to the server. This could lead to a privilege escalation event due via an account takeover. As a workaround you may cherry-pick the following commit from the project's repository to your running instance of NodeBB: 16cee1b03ba3eee177834a1fdac4aa8a12b39d2a. This is fixed in version 1.14.3.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269, CWE-287
References: http://packetstormsecurity.com/files/159560/NodeBB-Forum-1.14.2-Account-Takeover.html; https://github.com/NodeBB/NodeBB/commit/c2477d9d5ffc43e5ffeb537ea2ceb4ce9592aa39; https://github.com/NodeBB/NodeBB/security/advisories/GHSA-hr66-c8pg-5mg7
CVE: CVE-2020-15151
Published: 2020-08-20
Description: OpenMage LTS before versions 19.4.6 and 20.0.2 allows attackers to circumvent the `fromkey protection` in the Admin Interface and increases the attack surface for Cross Site Request Forgery attacks. This issue is related to Adobe's CVE-2020-9690. It is patched in versions 19.4.6 and 20.0.2.
CVSS Score: 8.0 (HIGH)
CWE: CWE-203, CWE-352
References: https://github.com/OpenMage/magento-lts/commit/7c526bc6a6a51b57a1bab4c60f104dc36cde347a; https://github.com/OpenMage/magento-lts/security/advisories/GHSA-crf2-xm6x-46p6; https://helpx.adobe.com/security/products/magento/apsb20-47.html
CVE: CVE-2020-15531
Published: 2020-08-20
Description: Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air remote code execution vulnerability in Bluetooth LE in EFR32 SoCs and associated modules running Bluetooth SDK, supporting Central or Observer roles.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://github.com/darkmentorllc/jackbnimble/blob/master/host/pocs/silabs_efr32_extadv_rce.py; https://github.com/darkmentorllc/publications/tree/master/2020/TI_SILABS_BLE_RCEs; https://www.blackhat.com/us-20/briefings/schedule/#finding-new-bluetooth-low-energy-exploits-via-reverse-engineering-multiple-vendors-firmwares-19655