deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7495
Published: 2020-06-16
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability during zip file extraction exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD) which could cause unauthorized write access outside of expected path folder when opening the project file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2020-133-04; https://www.se.com/ww/en/download/document/SEVD-2020-133-04
CVE: CVE-2020-7496
Published: 2020-06-16
Description: A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)which could cause unauthorized write access when opening the project file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88, CWE-88
References: https://www.se.com/ww/en/download/document/SEVD-2020-133-04; https://www.se.com/ww/en/download/document/SEVD-2020-133-04
CVE: CVE-2020-7497
Published: 2020-06-16
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formerly known as Vijeo XD)which could cause arbitrary application execution when the computer starts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2020-133-04; https://www.se.com/ww/en/download/document/SEVD-2020-133-04
CVE: CVE-2020-7498
Published: 2020-06-16
Description: A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-02; https://www.se.com/ww/en/download/document/SEVD-2020-161-02
CVE: CVE-2020-7499
Published: 2020-06-16
Description: A CWE-863: Incorrect Authorization vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause unauthorized access when a low privileged user makes unauthorized changes.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.se.com/ww/en/download/document/SEVD-2020-133-03/; https://www.se.com/ww/en/download/document/SEVD-2020-133-03/
CVE: CVE-2020-7500
Published: 2020-06-16
Description: A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability exists in U.motion Servers and Touch Panels (affected versions listed in the security notification) which could cause arbitrary code to be executed when a malicious command is entered.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.se.com/ww/en/download/document/SEVD-2020-133-03/; https://www.se.com/ww/en/download/document/SEVD-2020-133-03/
CVE: CVE-2020-7501
Published: 2020-06-16
Description: A CWE-798: Use of Hard-coded Credentials vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 16 and prior) and Vijeo Designer (V6.2 SP9 and prior) which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.se.com/ww/en/download/document/SEVD-2020-133-02/; https://www.se.com/ww/en/download/document/SEVD-2020-133-02/
CVE: CVE-2020-7502
Published: 2020-06-16
Description: A CWE-787: Out-of-bounds Write vulnerability exists in Modicon M218 Logic Controller (Firmware version 4.3 and prior), which may cause a Denial of Service when specific TCP/IP crafted packets are sent to the Modicon M218 Logic Controller.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-01; https://www.se.com/ww/en/download/document/SEVD-2020-161-01
CVE: CVE-2020-7503
Published: 2020-06-16
Description: A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to execute malicious commands on behalf of a legitimate user when xsrf-token data is intercepted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7504
Published: 2020-06-16
Description: A CWE-20: Improper Input Validation vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to disable the webserver service on the device when specially crafted network packets are sent.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7505
Published: 2020-06-16
Description: A CWE-494 Download of Code Without Integrity Check vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to inject data with dangerous content into the firmware and execute arbitrary code on the system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-494, CWE-494
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7506
Published: 2020-06-16
Description: A CWE-200: Information Exposure vulnerability exists in Easergy T300, Firmware V1.5.2 and prior, which could allow an attacker to pack or unpack the archive with the firmware for the controller and modules using the usual tar archiver resulting in an information exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2020-161-04
CVE: CVE-2020-7507
Published: 2020-06-16
Description: A CWE-400: Uncontrolled Resource Consumption vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to login multiple times resulting in a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7508
Published: 2020-06-16
Description: A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to gain full access by brute force.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7509
Published: 2020-06-16
Description: A CWE-269: Improper privilege management (write) vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to elevate their privileges and delete files.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269, CWE-269
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7510
Published: 2020-06-16
Description: A CWE-200: Information Exposure vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow attacker to obtain private keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7511
Published: 2020-06-16
Description: A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to acquire a password by brute force.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7512
Published: 2020-06-16
Description: A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to exploit the component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1103
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2020-7513
Published: 2020-06-16
Description: A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to intercept traffic and read configuration data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://www.se.com/ww/en/download/document/SEVD-2020-161-04; https://www.se.com/ww/en/download/document/SEVD-2020-161-04
CVE: CVE-2019-17655
Published: 2020-06-16
Description: A cleartext storage in a file or on disk (CWE-313) vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on the targeted device's system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312
References: https://fortiguard.com/psirt/FG-IR-19-217; https://fortiguard.com/psirt/FG-IR-20-224; https://fortiguard.com/psirt/FG-IR-19-217
CVE: CVE-2020-9289
Published: 2020-06-16
Description: Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiManager 6.2.3 and below, FortiAnalyzer 6.2.3 and below may allow an attacker with access to the CLI configuration or the CLI backup file to decrypt the sensitive data, via knowledge of the hard-coded key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://fortiguard.com/psirt/FG-IR-19-007; https://fortiguard.com/psirt/FG-IR-19-007
CVE: CVE-2020-14210
Published: 2020-06-16
Description: Reflected Cross-Site Scripting (XSS) vulnerability in MONITORAPP WAF in which script can be executed when responding to Request URL information. It provides a function to response to Request URL information when blocking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/kbgsft/vuln-AIWAF/wiki/Cross-site-scripting%28XSS%29-vulnerability-in-AIWAF-in-MONITORAPP-by-xcuter; https://github.com/monitorapp-aicc/report/wiki/CVE-2020-14210; https://github.com/kbgsft/vuln-AIWAF/wiki/Cross-site-scripting%28XSS%29-vulnerability-in-AIWAF-in-MONITORAPP-by-xcuter
CVE: CVE-2020-14212
Published: 2020-06-16
Description: FFmpeg through 4.3 has a heap-based buffer overflow in avio_get_str in libavformat/aviobuf.c because dnn_backend_native.c calls ff_dnn_load_model_native and a certain index check is omitted.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://patchwork.ffmpeg.org/project/ffmpeg/list/?series=1463; https://security.gentoo.org/glsa/202007-58; https://trac.ffmpeg.org/ticket/8716
CVE: CVE-2020-4052
Published: 2020-06-16
Description: In Wiki.js before 2.4.107, there is a stored cross-site scripting through template injection. This vulnerability exists due to an insecure validation mechanism intended to insert v-pre tags into rendered HTML elements which contain curly-braces. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. This has been patched in 2.4.107.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3; https://github.com/Requarks/wiki/security/advisories/GHSA-9jgg-4xj2-vjjj; https://github.com/Requarks/wiki/commit/9e08718ee904046f8b2294ef6ac79e8a75a451e3
CVE: CVE-2020-4053
Published: 2020-06-16
Description: In Helm greater than or equal to 3.0.0 and less than 3.2.4, a path traversal attack is possible when installing Helm plugins from a tar archive over HTTP. It is possible for a malicious plugin author to inject a relative path into a plugin archive, and copy a file outside of the intended directory. This has been fixed in 3.2.4.
CVSS Score: 3.7 (LOW)
CWE: CWE-22
References: https://github.com/helm/helm/commit/0ad800ef43d3b826f31a5ad8dfbb4fe05d143688; https://github.com/helm/helm/releases/tag/v3.2.4; https://github.com/helm/helm/security/advisories/GHSA-qq3j-xp49-j73f
CVE: CVE-2020-4054
Published: 2020-06-16
Description: In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9; https://github.com/rgrove/sanitize/releases/tag/v5.2.1; https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m
CVE: CVE-2020-14213
Published: 2020-06-16
Description: In Zammad before 3.3.1, a Customer has ticket access that should only be available to an Agent (e.g., read internal data, split, or merge).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://github.com/zammad/zammad/commit/6e56aee25439b7a3211a6704a9d60453ad623ae4; https://zammad.com/news/security-advisory-zaa-2020-13; https://github.com/zammad/zammad/commit/6e56aee25439b7a3211a6704a9d60453ad623ae4
CVE: CVE-2020-14214
Published: 2020-06-16
Description: Zammad before 3.3.1, when Domain Based Assignment is enabled, relies on a claimed e-mail address for authorization decisions. An attacker can register a new account that will have access to all tickets of an arbitrary Organization.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/zammad/zammad/commit/[PII_REDACTED]6f626cb779c76d6bdda0f67bd6069d; https://zammad.com/news/security-advisory-zaa-2020-12; https://github.com/zammad/zammad/commit/[PII_REDACTED]6f626cb779c76d6bdda0f67bd6069d
CVE: CVE-2020-11896
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-119, CWE-787
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://cert-portal.siemens.com/productcert/pdf/ssa-631949.pdf; https://jsof-tech.com/vulnerability-disclosure-policy/
CVE: CVE-2020-11897
Published: 2020-06-17
Description: The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-787
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC
CVE: CVE-2020-11898
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11899
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://cwe.mitre.org/data/definitions/125.html; https://jsof-tech.com/vulnerability-disclosure-policy/
CVE: CVE-2020-11900
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.
CVSS Score: 8.2 (HIGH)
CWE: CWE-415
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11901
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-125, CWE-131, CWE-330, CWE-787
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-treck-ip-stack-JyBQ5GyC
CVE: CVE-2020-11902
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.
CVSS Score: 7.3 (HIGH)
CWE: CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11903
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11904
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190, CWE-787, CWE-190
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11905
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11906
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-191
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11907
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.
CVSS Score: 6.3 (MEDIUM)
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11908
Published: 2020-06-17
Description: The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.
CVSS Score: 4.3 (MEDIUM)
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11909
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-191, CWE-191
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11910
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11911
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11912
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11913
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-11914
Published: 2020-06-17
Description: The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-006.txt; https://jsof-tech.com/vulnerability-disclosure-policy/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-13224
Published: 2020-06-17
Description: TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC230 devices through 1.3.1 build 200401, NC250 devices through 1.3.1 build 200401, NC260 devices through 1.5.3 build_200401, and NC450 devices through 1.5.4 build 200401 have a Buffer Overflow
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: http://packetstormsecurity.com/files/158115/TP-LINK-Cloud-Cameras-NCXXX-Stack-Overflow.html; https://www.tp-link.com/us/security; http://packetstormsecurity.com/files/158115/TP-LINK-Cloud-Cameras-NCXXX-Stack-Overflow.html
CVE: CVE-2020-10747
Published: 2020-06-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-12827
Published: 2020-06-17
Description: MJML prior to 4.6.3 contains a path traversal vulnerability when processing the mj-include directive within an MJML document.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html; http://seclists.org/fulldisclosure/2020/Jun/23; https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12
CVE: CVE-2020-14295
Published: 2020-06-17
Description: A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html; http://packetstormsecurity.com/files/162384/Cacti-1.2.12-SQL-Injection-Remote-Code-Execution.html