deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-2122
Published: 2020-02-12
Description: Jenkins Brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability exploitable by users able to control the Brakeman post-build step input data.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1644; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2123
Published: 2020-02-12
Description: Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1733; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2124
Published: 2020-02-12
Description: Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1560; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2125
Published: 2020-02-12
Description: Jenkins Debian Package Builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1558; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2126
Published: 2020-02-12
Description: Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1559; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2127
Published: 2020-02-12
Description: Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1547; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2128
Published: 2020-02-12
Description: Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1549; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2129
Published: 2020-02-12
Description: Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1552; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2130
Published: 2020-02-12
Description: Jenkins Harvest SCM Plugin 0.5.1 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1553; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2131
Published: 2020-02-12
Description: Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1553; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2132
Published: 2020-02-12
Description: Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1562; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-2133
Published: 2020-02-12
Description: Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2020/02/12/3; https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1540; http://www.openwall.com/lists/oss-security/2020/02/12/3
CVE: CVE-2020-8595
Published: 2020-02-12
Description: Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://access.redhat.com/errata/RHSA-2020:0477; https://access.redhat.com/security/cve/cve-2020-8595; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8595
CVE: CVE-2020-8815
Published: 2020-02-12
Description: Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowloris approach by sending a large volume of small packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/kolya5544/BearFTP; https://github.com/kolya5544/BearFTP/blob/f5a8047587c1a96456d4f291c12b038b9ab0d0c5/BearFTP/Program.cs#L503-L525; https://github.com/kolya5544/BearFTP/commit/17a6ead72d4a25cbfcef5e27613aa0a5f88a4b26
CVE: CVE-2020-8839
Published: 2020-02-12
Description: Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/156289/CHIYU-BF430-TCP-IP-Converter-Cross-Site-Scripting.html; https://drive.google.com/open?id=1eDN0rsGPs4-yxeMxl7MGh__yjdbl-wON; http://packetstormsecurity.com/files/156289/CHIYU-BF430-TCP-IP-Converter-Cross-Site-Scripting.html
CVE: CVE-2013-1924
Published: 2020-02-12
Description: Commerce Skrill (Formerly Moneybookers) has an Access bypass vulnerability in all versions prior to 7.x-1.2
CVSS Score: 7.5 (HIGH)
References: http://drupal.org/node/1960338; http://www.openwall.com/lists/oss-security/2013/04/04/6; http://drupal.org/node/1960338
CVE: CVE-2013-1938
Published: 2020-02-12
Description: Zimbra 2013 has XSS in aspell.php
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/04/09/14; http://www.openwall.com/lists/oss-security/2013/04/09/15; http://www.securityfocus.com/bid/58913
CVE: CVE-2013-2097
Published: 2020-02-12
Description: ZPanel through 10.1.0 has Remote Command Execution
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/134030/Zpanel-10.1.0-Remote-Unauthenticated-Code-Execution.html; http://www.exploit-db.com/exploits/25519; http://www.openwall.com/lists/oss-security/2013/05/16/12
CVE: CVE-2013-3494
Published: 2020-02-12
Description: A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external libraries. which could let a malicious user execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/89262; https://exchange.xforce.ibmcloud.com/vulnerabilities/89262
CVE: CVE-2013-3685
Published: 2020-02-12
Description: A Privilege Escalation Vulnerability exists in Sprite Software Spritebud 1.3.24 and 1.3.28 and Backup 2.5.4105 and 2.5.4108 on LG Android smartphones due to a race condition in the spritebud daemon, which could let a local malicious user obtain root privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/60749; https://androidvulnerabilities.org/all; https://exchange.xforce.ibmcloud.com/vulnerabilities/85296
CVE: CVE-2013-4090
Published: 2020-02-12
Description: Varnish HTTP cache before 3.0.4: ACL bug
CVSS Score: 7.5 (HIGH)
References: https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-June/000684.html; https://www.varnish-cache.org/lists/pipermail/varnish-announce/2013-June/000684.html
CVE: CVE-2013-4395
Published: 2020-02-12
Description: Simple Machines Forum (SMF) through 2.0.5 has XSS
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2013/10/01/8; http://www.openwall.com/lists/oss-security/2013/10/02/1; http://www.openwall.com/lists/oss-security/2013/10/02/3
CVE: CVE-2013-6236
Published: 2020-02-12
Description: IZON IP 2.0.2: hard-coded password vulnerability
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/88337; https://packetstormsecurity.com/files/cve/CVE-2013-6236; https://seclists.org/bugtraq/2013/Oct/149
CVE: CVE-2013-6681
Published: 2020-02-12
Description: Tube Map Live Underground for Android before 3.0.22 has an Information Disclosure Vulnerability
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/64039; https://exchange.xforce.ibmcloud.com/vulnerabilities/89849; http://www.securityfocus.com/bid/64039
CVE: CVE-2019-4427
Published: 2020-02-12
Description: IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer with malicious software inside. IBM X-Force ID: 162773.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162773; https://www.ibm.com/support/pages/node/1356087; https://exchange.xforce.ibmcloud.com/vulnerabilities/162773
CVE: CVE-2019-4431
Published: 2020-02-12
Description: IBM Rational Publishing Engine 6.0.6 and 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 162888.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/162888; https://www.ibm.com/support/pages/node/1942929; https://exchange.xforce.ibmcloud.com/vulnerabilities/162888
CVE: CVE-2019-4741
Published: 2020-02-12
Description: IBM Content Navigator 3.0CD is vulnerable to Server Side Request Forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 172815.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172815; https://www.ibm.com/support/pages/node/1846569; https://exchange.xforce.ibmcloud.com/vulnerabilities/172815
CVE: CVE-2011-4661
Published: 2020-02-12
Description: A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820), when configured with Cisco ISR Web Security with Cisco ScanSafe and User Authenticaiton NTLM configured.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://www.cisco.com/c/en/us/td/docs/ios/15_2m_and_t/release/notes/15_2m_and_t/152-1TCAVS.html; https://www.cisco.com/c/en/us/td/docs/ios/15_2m_and_t/release/notes/15_2m_and_t/152-1TCAVS.html
CVE: CVE-2012-0951
Published: 2020-02-12
Description: A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-0951.html; https://vuldb.com/?id.10060; http://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-0951.html
CVE: CVE-2013-2637
Published: 2020-02-12
Description: A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-updates/2013-08/msg00027.html; http://www.exploit-db.com/exploits/24922; http://www.securityfocus.com/bid/58930
CVE: CVE-2020-7046
Published: 2020-02-12
Description: lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://www.openwall.com/lists/oss-security/2020/02/12/1; https://dovecot.org/pipermail/dovecot-news/2020-February/000431.html; https://dovecot.org/security
CVE: CVE-2020-7957
Published: 2020-02-12
Description: The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the snippet and a trailing > character exists. This causes a denial of service in which the recipient cannot read all of their messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2020/02/12/2; https://dovecot.org/pipermail/dovecot-news/2020-February/000430.html; https://dovecot.org/security
CVE: CVE-2013-7286
Published: 2020-02-12
Description: MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: http://seclists.org/fulldisclosure/2014/Apr/21; https://exchange.xforce.ibmcloud.com/vulnerabilities/92352; http://seclists.org/fulldisclosure/2014/Apr/21
CVE: CVE-2014-3860
Published: 2020-02-12
Description: Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://packetstormsecurity.com/files/126882/Xilisoft-Video-Converter-Ultimate-7.8.1-build-20140505-DLL-Hijacking.html; http://packetstormsecurity.com/files/126882/Xilisoft-Video-Converter-Ultimate-7.8.1-build-20140505-DLL-Hijacking.html
CVE: CVE-2019-11867
Published: 2020-02-12
Description: Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greater than zero bytes. To exploit this vulnerability, an attacker must send an IRP with a system buffer size of 0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://downwithup.github.io/CVEPosts.html; https://www.realtek.cz/realtek-network-drivers.html; https://downwithup.github.io/CVEPosts.html
CVE: CVE-2019-16336
Published: 2020-02-12
Description: The Bluetooth Low Energy implementation in Cypress PSoC 4 BLE component 3.61 and earlier processes data channel frames with a payload length larger than the configured link layer maximum RX payload size, which allows attackers (in radio range) to cause a denial of service (crash) via a crafted BLE Link Layer frame.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://asset-group.github.io/disclosures/sweyntooth/; https://community.cypress.com/thread/48573; https://community.cypress.com/thread/53680
CVE: CVE-2020-8945
Published: 2020-02-12
Description: The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://access.redhat.com/errata/RHSA-2020:0679; https://access.redhat.com/errata/RHSA-2020:0689; https://access.redhat.com/errata/RHSA-2020:0697
CVE: CVE-2020-8946
Published: 2020-02-12
Description: Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://sku11army.blogspot.com/2020/02/netis-authenticated-rce-on-wf2471.html; https://sku11army.blogspot.com/2020/02/netis-authenticated-rce-on-wf2471.html
CVE: CVE-2020-8947
Published: 2020-02-12
Description: functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/156326/Pandora-FMS-7.0-Authenticated-Remote-Code-Execution.html; https://engindemirbilek.github.io/pandorafms-rce; https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/pandorafms-rce.html
CVE: CVE-2011-4338
Published: 2020-02-12
Description: Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://bbs.archlinux.org/viewtopic.php?id=64066&p=1; https://www.openwall.com/lists/oss-security/2011/11/22/4; https://bbs.archlinux.org/viewtopic.php?id=64066&p=1
CVE: CVE-2013-3725
Published: 2020-02-12
Description: Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution.
CVSS Score: 9.8 (CRITICAL)
References: http://www.john-jean.com/blog/securite-informatique/ipb-invision-power-board-all-versions-1-x-2-x-3-x-admin-account-takeover-leading-to-code-execution-742; http://www.john-jean.com/blog/securite-informatique/ipb-invision-power-board-all-versions-1-x-2-x-3-x-admin-account-takeover-leading-to-code-execution-742
CVE: CVE-2019-17519
Published: 2020-02-12
Description: The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://asset-group.github.io/disclosures/sweyntooth/; https://asset-group.github.io/disclosures/sweyntooth/
CVE: CVE-2019-19192
Published: 2020-02-12
Description: The Bluetooth Low Energy implementation on STMicroelectronics BLE Stack through 1.3.1 for STM32WB5x devices does not properly handle consecutive Attribute Protocol (ATT) requests on reception, allowing attackers in radio range to cause an event deadlock or crash via crafted packets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://asset-group.github.io/disclosures/sweyntooth/; https://asset-group.github.io/disclosures/sweyntooth/
CVE: CVE-2020-8949
Published: 2020-02-12
Description: Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://sku11army.blogspot.com/2020/02/gocloud-rce-in-gocloud-routers.html; https://sku11army.blogspot.com/2020/02/gocloud-rce-in-gocloud-routers.html
CVE: CVE-2011-2343
Published: 2020-02-12
Description: The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://code.google.com/p/android/issues/detail?id=21347; https://deepsec.net/docs/Slides/2013/DeepSec_2013_Jaime_Sanchez_-_Building_The_First_Android_IDS_On_Network_Level.pdf; https://code.google.com/p/android/issues/detail?id=21347
CVE: CVE-2011-2499
Published: 2020-02-12
Description: Mambo CMS through 4.6.5 has multiple XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.openwall.com/lists/oss-security/2011/06/28/15; https://www.openwall.com/lists/oss-security/2011/06/28/15
CVE: CVE-2011-3336
Published: 2020-02-12
Description: regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://seclists.org/fulldisclosure/2014/Mar/166; http://www.securityfocus.com/bid/50541; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2011-3901
Published: 2020-02-12
Description: Android SQLite Journal before 4.0.1 has an information disclosure vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/53380; https://seclists.org/fulldisclosure/2012/May/19; http://www.securityfocus.com/bid/53380
CVE: CVE-2020-6177
Published: 2020-02-12
Description: SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2880993; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812; https://launchpad.support.sap.com/#/notes/2880993
CVE: CVE-2020-6181
Published: 2020-02-12
Description: Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability.
CVSS Score: 5.8 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2880744; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812; https://launchpad.support.sap.com/#/notes/2880744
CVE: CVE-2020-6183
Published: 2020-02-12
Description: SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2836445; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812; https://launchpad.support.sap.com/#/notes/2836445