deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15883
Published: 2020-07-23
Description: A Cross-Site Scripting (XSS) vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters (through which installed packages names and versions are reported).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/munkireport/managedinstalls/releases/tag/v2.6; https://github.com/munkireport/munkireport-php; https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
CVE: CVE-2020-15884
Published: 2020-07-23
Description: A SQL injection vulnerability in TableQuery.php in MunkiReport before 5.6.3 allows attackers to execute arbitrary SQL commands via the order[0][dir] field on POST requests to /datatables/data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/munkireport/munkireport-php/releases; https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3; https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Datatables-Order-By-In-Post-Body
CVE: CVE-2020-15885
Published: 2020-07-23
Description: A Cross-Site Scripting (XSS) vulnerability in the comment module before 4.0 for MunkiReport allows remote attackers to inject arbitrary web script or HTML by posting a new comment.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/munkireport/comment/releases; https://github.com/munkireport/munkireport-php; https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
CVE: CVE-2020-15886
Published: 2020-07-23
Description: A SQL injection vulnerability in reportdata_controller.php in the reportdata module before 3.5 for MunkiReport allows attackers to execute arbitrary SQL commands via the req parameter of the /module/reportdata/ip endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/munkireport/munkireport-php/releases; https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3; https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-In-Reportdata-Ip-In-%27req%27-GET-Parameter
CVE: CVE-2020-15887
Published: 2020-07-23
Description: A SQL injection vulnerability in softwareupdate_controller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/get_tab_data/ endpoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/munkireport/munkireport-php/releases; https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3; https://github.com/munkireport/munkireport-php/wiki/20200722-SQL-Injection-in-softwareupdate-module
CVE: CVE-2019-11252
Published: 2020-07-23
Description: The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://github.com/kubernetes/kubernetes/pull/88684; https://github.com/kubernetes/kubernetes/pull/88684
CVE: CVE-2020-15912
Published: 2020-07-23
Description: Tesla Model 3 vehicles allow attackers to open a door by leveraging access to a legitimate key card, and then using NFC Relay. NOTE: the vendor has developed Pin2Drive to mitigate this issue
CVSS Score: 6.5 (MEDIUM)
References: https://cansecwest.com/post/2020-03-09-22:00:00_2020_Speakers; https://twitter.com/Kevin2600/status/[PII_REDACTED]82836224; https://www.carhackingvillage.com/speaker-bios#htm3nrr
CVE: CVE-2020-10918
Published: 2020-07-23
Description: This vulnerability allows remote attackers to bypass authentication on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authentication mechanism. The issue is due to insufficient authentication on post-authentication requests. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from unauthenticated users. Was ZDI-CAN-10182.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.zerodayinitiative.com/advisories/ZDI-20-805/; https://www.zerodayinitiative.com/advisories/ZDI-20-805/
CVE: CVE-2020-10919
Published: 2020-07-23
Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. When transmitting passwords, the process encrypts them in a recoverable format. An attacker can leverage this vulnerability to disclose credentials, leading to further compromise. Was ZDI-CAN-10185.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-261, CWE-326
References: https://www.zerodayinitiative.com/advisories/ZDI-20-806/; https://www.zerodayinitiative.com/advisories/ZDI-20-806/
CVE: CVE-2020-10920
Published: 2020-07-23
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service, which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10493.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-20-808/; https://www.zerodayinitiative.com/advisories/ZDI-20-808/
CVE: CVE-2020-10921
Published: 2020-07-23
Description: This vulnerability allows remote attackers to issue commands on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to issue commands to the physical equipment controlled by the device. Was ZDI-CAN-10482.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://www.zerodayinitiative.com/advisories/ZDI-20-807/; https://www.zerodayinitiative.com/advisories/ZDI-20-807/
CVE: CVE-2020-10922
Published: 2020-07-23
Description: This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EA-HTTP.exe process. The issue results from the lack of proper input validation prior to further processing user requests. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-10527.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.zerodayinitiative.com/advisories/ZDI-20-809/; https://www.zerodayinitiative.com/advisories/ZDI-20-809/
CVE: CVE-2020-12638
Published: 2020-07-23
Description: An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTOS_SDK devices through 3.3. Broadcasting forged beacon frames forces a device to change its authentication mode to OPEN, effectively disabling its 802.11 encryption.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287, CWE-319
References: https://github.com/espressif/ESP8266_NONOS_SDK; https://github.com/espressif/ESP8266_RTOS_SDK; https://github.com/espressif/esp-idf
CVE: CVE-2020-4447
Published: 2020-07-23
Description: IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 181227.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181227; https://www.ibm.com/support/pages/node/6208453; https://exchange.xforce.ibmcloud.com/vulnerabilities/181227
CVE: CVE-2020-8557
Published: 2020-07-23
Description: The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/kubernetes/kubernetes/issues/93032; https://groups.google.com/g/kubernetes-security-announce/c/cB_JUsYEKyY/m/vVSO61AhBwAJ; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-15916
Published: 2020-07-23
Description: goform/AdvSetLanip endpoint on Tenda AC15 AC1900 15.03.05.19 devices allows remote attackers to execute arbitrary system commands via shell metacharacters in the lanIp POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68; https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE: CVE-2020-15917
Published: 2020-07-23
Description: common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00090.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00060.html
CVE: CVE-2019-18834
Published: 2020-07-23
Description: Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCS_Admin_Post_Types in class-wcs-admin-post-types.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://woocommerce.com/products/woocommerce-subscriptions/; https://www.precursorsecurity.com/blog; https://www.precursorsecurity.com/blog/woocommerce-subscriptions-persistent-xss-cve-2019-18834
CVE: CVE-2020-11623
Published: 2020-07-23
Description: An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. An attacker with physical access to the UART interface could access additional diagnostic and configuration functionalities as well as the camera's bootloader. Successful exploitation could compromise confidentiality, integrity, and availability of the affected system. It could even render the device inoperable.
CVSS Score: 6.8 (MEDIUM)
References: https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/; https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/
CVE: CVE-2020-15391
Published: 2020-07-23
Description: The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://github.com/devspace-cloud/devspace/releases/tag/v4.14.0; https://github.com/devspace-cloud/devspace/tags; https://github.com/devspace-cloud/devspace/releases/tag/v4.14.0
CVE: CVE-2020-15477
Published: 2020-07-23
Description: The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85; https://github.com/raspberrytorte/tortoise/tree/master/nodejs; https://gist.github.com/PreethamBomma/e7b6d220790f95555dc2c5ac1d7d2f85
CVE: CVE-2020-15492
Published: 2020-07-23
Description: An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://packetstormsecurity.com/files/158556/INNEO-Startup-TOOLS-2018-M040-13.0.70.3804-Remote-Code-Execution.html; https://www.inneo.co.uk/en/product-development/inneo-in-house-products/startup-tools.html; https://www.inneo.de/files/content/Produktentwicklung/Tools-und-Erweiterungen/Startup-TOOLS/INNEO-SA-SUT-2020-01.pdf
CVE: CVE-2020-11624
Published: 2020-07-23
Description: An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. They do not require users to change the default password for the admin account. They only show a pop-up window suggesting a change but there's no enforcement. An administrator can click Cancel and proceed to use the device without changing the password. Additionally, they disclose the default username within the login.js script. Since many attacks for IoT devices, including malware and exploits, are based on the usage of default credentials, it makes these cameras an easy target for malicious actors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/; https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/
CVE: CVE-2020-11625
Published: 2020-07-23
Description: An issue was discovered in AvertX Auto focus Night Vision HD Indoor/Outdoor IP Dome Camera HD838 and Night Vision HD Indoor/Outdoor Mini IP Bullet Camera HD438. Failed web UI login attempts elicit different responses depending on whether a user account exists. Because the responses indicate whether a submitted username is valid or not, they make it easier to identify legitimate usernames. If a login request is sent to ISAPI/Security/sessionLogin/capabilities using a username that exists, it will return the value of the salt given to that username, even if the password is incorrect. However, if a login request is sent using a username that is not present in the database, it will return an empty salt value. This allows attackers to enumerate legitimate usernames, facilitating brute-force attacks. NOTE: this is different from CVE-2020-7057.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/; https://unit42.paloaltonetworks.com/avertx-ip-cameras-vulnerabilities/
CVE: CVE-2020-15631
Published: 2020-07-23
Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 1.04B03_HOTFIX WiFi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction header, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10084.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10185; https://www.zerodayinitiative.com/advisories/ZDI-20-879/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10185
CVE: CVE-2020-15632
Published: 2020-07-23
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.
CVSS Score: 8.8 (HIGH)
CWE: CWE-303
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10184; https://www.zerodayinitiative.com/advisories/ZDI-20-880/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10184
CVE: CVE-2020-15633
Published: 2020-07-23
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.20B10_BETA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP requests. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-10835.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10186; https://www.zerodayinitiative.com/advisories/ZDI-20-881/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10186
CVE: CVE-2020-7491
Published: 2020-07-23
Description: **VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network and could allow inappropriate access. This vulnerability was remediated in TCM version 10.5.4.
CVSS Score: 7.5 (HIGH)
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01; https://www.se.com/ww/en/download/document/SESB-2020-105-01/; https://us-cert.cisa.gov/ics/advisories/icsa-20-205-01
CVE: CVE-2020-7514
Published: 2020-07-23
Description: A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker access to the authorization credentials for a device and gain full access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-05; https://www.se.com/ww/en/download/document/SEVD-2020-161-05
CVE: CVE-2020-7515
Published: 2020-07-23
Description: A CWE-321: Use of hard-coded cryptographic key stored in cleartext vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker to decrypt a password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-05; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-05
CVE: CVE-2020-7516
Published: 2020-07-23
Description: A CWE-316: Cleartext Storage of Sensitive Information in Memory vulnerability exists in Easergy Builder V1.4.7.2 and prior which could allow an attacker access to login credentials.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312, CWE-312
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-05; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-05
CVE: CVE-2020-7517
Published: 2020-07-23
Description: A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to read user credentials.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-05; https://www.se.com/ww/en/download/document/SEVD-2020-161-05
CVE: CVE-2020-7518
Published: 2020-07-23
Description: A CWE-20: Improper input validation vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to modify project configuration files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-05; https://www.se.com/ww/en/download/document/SEVD-2020-161-05
CVE: CVE-2020-7519
Published: 2020-07-23
Description: A CWE-521: Weak Password Requirements vulnerability exists in Easergy Builder (Version 1.4.7.2 and older) which could allow an attacker to compromise a user account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521, CWE-521
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-05; https://www.se.com/ww/en/download/document/SEVD-2020-161-05
CVE: CVE-2020-7520
Published: 2020-07-23
Description: A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU), V2.4.0 and prior, which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability, an attacker requires privileged access on the engineering workstation to modify a Windows registry key which would divert all traffic updates to go through a server in the attacker's possession. A man-in-the-middle attack is then used to complete the exploit.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://www.se.com/ww/en/download/document/SEVD-2020-196-01/; https://www.se.com/ww/en/download/document/SEVD-2020-196-01/
CVE: CVE-2020-15918
Published: 2020-07-24
Description: Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html; https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
CVE: CVE-2020-15919
Published: 2020-07-24
Description: A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html; https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
CVE: CVE-2020-15920
Published: 2020-07-24
Description: There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/158991/Mida-eFramework-2.9.0-Remote-Code-Execution.html; http://packetstormsecurity.com/files/159194/Mida-Solutions-eFramework-ajaxreq.php-Command-Injection.html; https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
CVE: CVE-2020-15921
Published: 2020-07-24
Description: Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities, such as Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/159239/Mida-eFramework-2.9.0-Backdoor-Access.html; https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html; http://packetstormsecurity.com/files/159239/Mida-eFramework-2.9.0-Backdoor-Access.html
CVE: CVE-2020-15922
Published: 2020-07-24
Description: There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. Authentication is required.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://packetstormsecurity.com/files/159314/Mida-eFramework-2.8.9-Remote-Code-Execution.html; https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html; http://packetstormsecurity.com/files/159314/Mida-eFramework-2.8.9-Remote-Code-Execution.html
CVE: CVE-2020-15923
Published: 2020-07-24
Description: Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html; https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html