deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3388
Published: 2020-07-16
Description: A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI. The attacker must be authenticated to access the CLI. A successful exploit could allow the attacker to execute commands with root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-287
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clibypvman-sKcLf2L; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clibypvman-sKcLf2L
CVE: CVE-2020-3401
Published: 2020-07-16
Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct path traversal attacks and obtain read access to sensitive files on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to the affected system. A successful exploit could allow the attacker to view arbitrary files on the affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmandowndir-CVGvdKM3; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmandowndir-CVGvdKM3
CVE: CVE-2020-3405
Published: 2020-07-16
Description: A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access to information that is stored on an affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing certain XML files. An attacker could exploit this vulnerability by persuading a user to import a crafted XML file with malicious entries. A successful exploit could allow the attacker to read and write files within the affected application.
CVSS Score: 7.3 (HIGH)
CWE: CWE-611, CWE-611
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanxml-Aj4GFEKd; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanxml-Aj4GFEKd
CVE: CVE-2020-3406
Published: 2020-07-16
Description: A vulnerability in the web-based management interface of the Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanxss-z7bhvHpy; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanxss-z7bhvHpy
CVE: CVE-2020-3437
Published: 2020-07-16
Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying filesystem of the device. The vulnerability is due to insufficient file scope limiting. An attacker could exploit this vulnerability by creating a specific file reference on the filesystem and then accessing it through the web-based management interface. A successful exploit could allow the attacker to read arbitrary files from the filesystem of the underlying operating system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-59, CWE-59
References: http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanwebid-5QWMcCvt; http://packetstormsecurity.com/files/162958/Cisco-SD-WAN-vManage-19.2.2-Remote-Root.html
CVE: CVE-2020-3450
Published: 2020-07-16
Description: A vulnerability in the web-based management interface of Cisco Vision Dynamic Signage Director could allow an authenticated, remote attacker with administrative credentials to conduct SQL injection attacks on an affected system. The vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the web-based management interface and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data that is stored in the underlying database, including hashed user credentials. To exploit this vulnerability, an attacker would need valid administrative credentials.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-visio-dir-sql-inj-fPm3MPfT; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-visio-dir-sql-inj-fPm3MPfT
CVE: CVE-2020-3468
Published: 2020-07-16
Description: A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates values within SQL queries. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database or the operating system.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-v78FubGV; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-v78FubGV
CVE: CVE-2020-12011
Published: 2020-07-16
Description: A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02
CVE: CVE-2020-13405
Published: 2020-07-16
Description: userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a /modules/ POST request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6; https://rhinosecuritylabs.com/research/microweber-database-disclosure/; https://github.com/microweber/microweber/commit/269320e0e0e06a1785e1a1556da769a34280b7e6
CVE: CVE-2020-4095
Published: 2020-07-16
Description: "BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-312, CWE-522
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080772; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080772
CVE: CVE-2020-12009
Published: 2020-07-16
Description: A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02
CVE: CVE-2020-12007
Published: 2020-07-16
Description: A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C
CVE: CVE-2020-12013
Published: 2020-07-16
Description: A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-94, CWE-89
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02
CVE: CVE-2020-12015
Published: 2020-07-16
Description: A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
CVSS Score: 7.5 (HIGH)
CWE: CWE-502, CWE-502
References: https://www.us-cert.gov/ics/advisories/icsa-20-170-02; https://www.us-cert.gov/ics/advisories/icsa-20-170-03; https://www.us-cert.gov/ics/advisories/icsa-20-170-02
CVE: CVE-2020-11978
Published: 2020-07-17
Description: An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html; http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html; https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2020-11981
Published: 2020-07-17
Description: An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2020-11982
Published: 2020-07-17
Description: An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2020-11983
Published: 2020-07-17
Description: An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2020-9485
Published: 2020-07-17
Description: An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart pages of the the "classic" UI.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd[PII_REDACTED]ba9afe91%40%3Cusers.airflow.apache.org%3E
CVE: CVE-2020-9646
Published: 2020-07-17
Description: Adobe Media Encoder versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-36.html; https://www.zerodayinitiative.com/advisories/ZDI-20-883/; https://helpx.adobe.com/security/products/media-encoder/apsb20-36.html
CVE: CVE-2020-9649
Published: 2020-07-17
Description: Adobe Media Encoder versions 14.2 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-36.html; https://www.zerodayinitiative.com/advisories/ZDI-20-882/; https://helpx.adobe.com/security/products/media-encoder/apsb20-36.html
CVE: CVE-2020-9650
Published: 2020-07-17
Description: Adobe Media Encoder versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-36.html; https://www.zerodayinitiative.com/advisories/ZDI-20-884/; https://helpx.adobe.com/security/products/media-encoder/apsb20-36.html
CVE: CVE-2020-9669
Published: 2020-07-17
Description: Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a lack of exploit mitigations vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html; https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html
CVE: CVE-2020-9670
Published: 2020-07-17
Description: Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html; https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html
CVE: CVE-2020-9671
Published: 2020-07-17
Description: Adobe Creative Cloud Desktop Application versions 5.1 and earlier have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html; https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html
CVE: CVE-2020-9672
Published: 2020-07-17
Description: Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://helpx.adobe.com/security/products/coldfusion/apsb20-43.html; https://helpx.adobe.com/security/products/coldfusion/apsb20-43.html
CVE: CVE-2020-9673
Published: 2020-07-17
Description: Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://helpx.adobe.com/security/products/coldfusion/apsb20-43.html; https://helpx.adobe.com/security/products/coldfusion/apsb20-43.html
CVE: CVE-2020-9682
Published: 2020-07-17
Description: Adobe Creative Cloud Desktop Application versions 5.1 and earlier have a symlink vulnerability vulnerability. Successful exploitation could lead to arbitrary file system write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-59
References: https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html; https://helpx.adobe.com/security/products/creative-cloud/apsb20-33.html
CVE: CVE-2020-9688
Published: 2020-07-17
Description: Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://helpx.adobe.com/security/products/adm/apsb20-49.html; https://helpx.adobe.com/security/products/adm/apsb20-49.html
CVE: CVE-2020-15801
Published: 2020-07-17
Description: In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-426
References: https://bugs.python.org/issue41304; https://github.com/python/cpython/pull/21495; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-15803
Published: 2020-07-17
Description: Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before 4.4.10rc1, and 5.x before 5.0.2rc1 allows stored XSS in the URL Widget.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00007.html; https://lists.debian.org/debian-lts-announce/2020/08/msg00007.html; https://lists.debian.org/debian-lts-announce/2021/04/msg00018.html
CVE: CVE-2020-7684
Published: 2020-07-17
Description: This affects all versions of package rollup-plugin-serve. There is no path sanitization in readFile operation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://snyk.io/vuln/SNYK-JS-FASTHTTP-572886; https://vuldb.com/?id.158745; https://snyk.io/vuln/SNYK-JS-FASTHTTP-572886
CVE: CVE-2020-7696
Published: 2020-07-17
Description: This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/DylanVann/react-native-fast-image/issues/690; https://github.com/DylanVann/react-native-fast-image/pull/691; https://snyk.io/vuln/SNYK-JS-REACTNATIVEFASTIMAGE-572228
CVE: CVE-2020-4464
Published: 2020-07-17
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181489; https://www.ibm.com/support/pages/node/6250059; https://www.zerodayinitiative.com/advisories/ZDI-20-878/
CVE: CVE-2020-14001
Published: 2020-07-17
Description: The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://github.com/gettalong/kramdown; https://github.com/gettalong/kramdown/commit/1b8fd33c3120bfc6e5164b449e2c2fc9c9306fde; https://github.com/gettalong/kramdown/compare/REL_2_2_1...REL_2_3_0
CVE: CVE-2020-14039
Published: 2020-07-17
Description: In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifyOptions.Roots equals nil and the installation is on Windows). Thus, X.509 certificate verification is incomplete.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html
CVE: CVE-2020-14928
Published: 2020-07-17
Description: evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74
References: https://bugzilla.suse.com/show_bug.cgi?id=1173910; https://gitlab.gnome.org/GNOME//evolution-data-server/commit/ba82be72cfd427b5d72ff21f929b3a6d8529c4df; https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/f404f33fb01b23903c2bbb16791c7907e457fbac
CVE: CVE-2020-15586
Published: 2020-07-17
Description: Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and writes a response at the same time.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00077.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00082.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00029.html
CVE: CVE-2020-15807
Published: 2020-07-17
Description: GNU LibreDWG before 0.11 allows NULL pointer dereferences via crafted input files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/LibreDWG/libredwg/issues/186; https://github.com/LibreDWG/libredwg/issues/189; https://github.com/LibreDWG/libredwg/issues/190
CVE: CVE-2020-7825
Published: 2020-07-17
Description: A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An attacker could execute arbitrary remote command by sending parameters to WinExec function in ExtCommandApi.dll module of MiPlatform.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35509; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35509