deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-14474
Published: 2020-06-30
Description: The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software, and does not appear to be changed with each new build. It is possible to reconstruct the decryption process using the hardcoded key material and obtain easy access to otherwise protected data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: http://packetstormsecurity.com/files/158254/Cellebrite-EPR-Decryption-Hardcoded-AES-Key-Material.html; http://seclists.org/fulldisclosure/2020/Jun/31; https://korelogic.com/Resources/Advisories/KL-001-2020-003.txt
CVE: CVE-2020-7049
Published: 2020-06-30
Description: Nozomi Networks OS before 19.0.4 allows /#/network?tab=network_node_list.html CSV Injection.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1236
References: https://www2.deloitte.com/de/de/pages/risk/articles/nozomi-csv-injection.html?nc=1; https://www2.deloitte.com/de/de/pages/risk/articles/nozomi-csv-injection.html?nc=1
CVE: CVE-2020-9413
Published: 2020-06-30
Description: The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2020-9414
Published: 2020-06-30
Description: The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2020-14947
Published: 2020-06-30
Description: OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/158293/OCS-Inventory-NG-2.7-Remote-Code-Execution.html; https://drive.google.com/file/d/1-LVfL5ui5m2QfQxr0fDopzSECd4fTNrQ/view?usp=sharing; https://gist.github.com/mhaskar/233436d3096d4a7beafe36ff61dc2c73
CVE: CVE-2020-5968
Published: 2020-06-30
Description: NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed by using an index or pointer, such as memory or files, which may lead to code execution, denial of service, escalation of privileges, or information disclosure. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5031; https://nvidia.custhelp.com/app/answers/detail/a_id/5031
CVE: CVE-2020-5969
Published: 2020-06-30
Description: NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which it validates a shared resource before using it, creating a race condition which may lead to denial of service or information disclosure. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-362
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5031; https://nvidia.custhelp.com/app/answers/detail/a_id/5031
CVE: CVE-2020-5970
Published: 2020-06-30
Description: NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of service. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5031; https://nvidia.custhelp.com/app/answers/detail/a_id/5031
CVE: CVE-2020-5971
Published: 2020-06-30
Description: NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software reads from a buffer by using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer, which may lead to code execution, denial of service, escalation of privileges, or information disclosure. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5031; https://nvidia.custhelp.com/app/answers/detail/a_id/5031
CVE: CVE-2020-5972
Published: 2020-06-30
Description: NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which local pointer variables are not initialized and may be freed later, which may lead to tampering or denial of service. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).
CVSS Score: 7.1 (HIGH)
CWE: CWE-763
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5031; https://nvidia.custhelp.com/app/answers/detail/a_id/5031
CVE: CVE-2020-5973
Published: 2020-06-30
Description: NVIDIA Virtual GPU Manager and the guest drivers contain a vulnerability in vGPU plugin, in which there is the potential to execute privileged operations, which may lead to denial of service. This affects vGPU version 8.x (prior to 8.4), version 9.x (prior to 9.4) and version 10.x (prior to 10.3).
CVSS Score: 4.4 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5031; https://usn.ubuntu.com/4404-1/; https://usn.ubuntu.com/4404-2/
CVE: CVE-2019-20408
Published: 2020-07-01
Description: The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.7.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://jira.atlassian.com/browse/JRASERVER-71204; https://jira.atlassian.com/browse/JRASERVER-71204
CVE: CVE-2020-14164
Published: 2020-07-01
Description: The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-71184; https://jira.atlassian.com/browse/JRASERVER-71184
CVE: CVE-2020-14165
Published: 2020-07-01
Description: The UniversalAvatarResource.getAvatars resource in Jira Server and Data Center before version 8.9.0 allows remote attackers to obtain information about custom project avatars names via an Improper authorization vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-71185; https://jira.atlassian.com/browse/JRASERVER-71185
CVE: CVE-2020-14166
Published: 2020-07-01
Description: The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html; https://jira.atlassian.com/browse/JSDSERVER-6895; http://packetstormsecurity.com/files/162107/Atlassian-Jira-Service-Desk-4.9.1-Cross-Site-Scripting.html
CVE: CVE-2020-14167
Published: 2020-07-01
Description: The MessageBundleResource resource in Jira Server and Data Center before version 7.13.4, from 8.5.0 before 8.5.5, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to impact the application's availability via an Denial of Service (DoS) vulnerability.
CVSS Score: 7.5 (HIGH)
References: https://jira.atlassian.com/browse/JRASERVER-71197; https://jira.atlassian.com/browse/JRASERVER-71197
CVE: CVE-2020-14168
Published: 2020-07-01
Description: The email client in Jira Server and Data Center before version 7.13.16, from 8.5.0 before 8.5.7, from 8.8.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability.
CVSS Score: 5.9 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-71198; https://jira.atlassian.com/browse/JRASERVER-71198
CVE: CVE-2020-14169
Published: 2020-07-01
Description: The quick search component in Atlassian Jira Server and Data Center before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-71205; https://jira.atlassian.com/browse/JRASERVER-71205
CVE: CVE-2020-4022
Published: 2020-07-01
Description: The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a mixed multipart content type.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-71107; https://jira.atlassian.com/browse/JRASERVER-71107
CVE: CVE-2020-4024
Published: 2020-07-01
Description: The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a vnd.wap.xhtml+xml content type.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-71113; https://jira.atlassian.com/browse/JRASERVER-71113
CVE: CVE-2020-4025
Published: 2020-07-01
Description: The attachment download resource in Atlassian Jira Server and Data Center The attachment download resource in Atlassian Jira Server and Data Center before 8.5.5, and from 8.6.0 before 8.8.2, and from 8.9.0 before 8.9.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability issue attachments with a rdf content type.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-71114; https://jira.atlassian.com/browse/JRASERVER-71114
CVE: CVE-2020-4027
Published: 2020-07-01
Description: Affected versions of Atlassian Confluence Server and Data Center allowed remote attackers with system administration permissions to bypass velocity template injection mitigations via an injection vulnerability in custom user macros. The affected versions are before version 7.4.5, and from version 7.5.0 before 7.5.1.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-74
References: https://jira.atlassian.com/browse/CONFSERVER-59898; https://jira.atlassian.com/browse/CONFSERVER-59898
CVE: CVE-2020-4029
Published: 2020-07-01
Description: The /rest/project-templates/1.0/createshared resource in Atlassian Jira Server and Data Center before version 8.5.5, from 8.6.0 before 8.7.2, and from 8.8.0 before 8.8.1 allows remote attackers to enumerate project names via an improper authorization vulnerability.
CVSS Score: 4.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-70926; https://jira.atlassian.com/browse/JRASERVER-70926
CVE: CVE-2020-15468
Published: 2020-07-01
Description: Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/48190; https://www.exploit-db.com/exploits/48190
CVE: CVE-2020-15470
Published: 2020-07-01
Description: ffjpeg through 2020-02-24 has a heap-based buffer overflow in jfif_decode in jfif.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/rockcarry/ffjpeg/issues/26; https://github.com/rockcarry/ffjpeg/issues/26
CVE: CVE-2020-15471
Published: 2020-07-01
Description: In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/fuzzing2026/CVE-PoCs/tree/main/ndpi-CVE-2020-15471; https://github.com/ntop/nDPI/commit/61066fb106efa6d3d95b67e47b662de208b2b622; https://github.com/ntop/nDPI/commit/61066fb106efa6d3d95b67e47b662de208b2b622
CVE: CVE-2020-15472
Published: 2020-07-01
Description: In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/ntop/nDPI/commit/b7e666e465f138ae48ab81976726e67deed12701; https://lists.debian.org/debian-lts-announce/2022/08/msg00016.html; https://github.com/ntop/nDPI/commit/b7e666e465f138ae48ab81976726e67deed12701
CVE: CVE-2020-15473
Published: 2020-07-01
Description: In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/fuzzing2026/CVE-PoCs/tree/main/ndpi-CVE-2020-15473; https://github.com/ntop/nDPI/commit/8e7b1ea7a136cc4e4aa9880072ec2d69900a825e; https://github.com/ntop/nDPI/commit/8e7b1ea7a136cc4e4aa9880072ec2d69900a825e
CVE: CVE-2020-15474
Published: 2020-07-01
Description: In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/ntop/nDPI/commit/23594f[PII_REDACTED]72198a57c59b6e9d63caf6ce; https://github.com/ntop/nDPI/commit/23594f[PII_REDACTED]72198a57c59b6e9d63caf6ce
CVE: CVE-2020-15475
Published: 2020-07-01
Description: In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://github.com/ntop/nDPI/commit/6a9f5e4f7c3fd5ddab3e6727b071904d76773952; https://github.com/ntop/nDPI/commit/6a9f5e4f7c3fd5ddab3e6727b071904d76773952
CVE: CVE-2020-15476
Published: 2020-07-01
Description: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21780; https://github.com/ntop/nDPI/commit/b69177be2fbe01c2442239a61832c44e40136c05; https://lists.debian.org/debian-lts-announce/2020/08/msg00052.html
CVE: CVE-2020-15478
Published: 2020-07-01
Description: The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://docs.journal-theme.com/changelog; https://www.getastra.com/blog/911/plugin-exploit/sql-errors-data-exposure-in-journal-opencart-theme/; https://www.jinsonvarghese.com/sensitive-data-exposure-in-journal-theme/
CVE: CVE-2020-6261
Published: 2020-07-01
Description: SAP Solution Manager (Trace Analysis), version 7.20, allows an attacker to perform a log injection into the trace file, due to Incomplete XML Validation. The readability of the trace file is impaired.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-116
References: https://launchpad.support.sap.com/#/notes/2915126; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=547426775; https://launchpad.support.sap.com/#/notes/2915126
CVE: CVE-2017-1659
Published: 2020-07-01
Description: "HCL iNotes is susceptible to a Cross-Site Scripting (XSS) Vulnerability. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials."
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080512; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080512
CVE: CVE-2017-1712
Published: 2020-07-01
Description: "A vulnerability in the TLS protocol implementation of the Domino server could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080545; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080545
CVE: CVE-2020-12603
Published: 2020-07-01
Description: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/envoyproxy/envoy-setec/issues/80; https://github.com/envoyproxy/envoy/security/advisories/GHSA-pc38-4q6c-85p6; https://github.com/envoyproxy/envoy-setec/issues/80
CVE: CVE-2020-5900
Published: 2020-07-01
Description: In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.f5.com/csp/article/K31044532; https://support.f5.com/csp/article/K31044532
CVE: CVE-2020-7689
Published: 2020-07-01
Description: Data is truncated wrong when its length is greater than 255 bytes.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-190, CWE-327
References: https://github.com/kelektiv/node.bcrypt.js/issues/776; https://github.com/kelektiv/node.bcrypt.js/pull/806; https://github.com/kelektiv/node.bcrypt.js/pull/807
CVE: CVE-2019-4676
Published: 2020-07-01
Description: IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171512; https://www.ibm.com/support/pages/node/6242348; https://exchange.xforce.ibmcloud.com/vulnerabilities/171512
CVE: CVE-2019-4704
Published: 2020-07-01
Description: IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 172014.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-311
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172014; https://www.ibm.com/support/pages/node/6242348; https://exchange.xforce.ibmcloud.com/vulnerabilities/172014
CVE: CVE-2019-4705
Published: 2020-07-01
Description: IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 172015.
CVSS Score: 2.7 (LOW)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172015; https://www.ibm.com/support/pages/node/6242348; https://exchange.xforce.ibmcloud.com/vulnerabilities/172015
CVE: CVE-2019-4706
Published: 2020-07-01
Description: IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. IBM X-Force ID: 172016.
CVSS Score: 2.7 (LOW)
CWE: CWE-532
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/172016; https://www.ibm.com/support/pages/node/6242348; https://exchange.xforce.ibmcloud.com/vulnerabilities/172016
CVE: CVE-2020-12604
Published: 2020-07-01
Description: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window updates to consume the entire stream and does not reset the stream.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/envoyproxy/envoy/commits/master; https://github.com/envoyproxy/envoy/security/advisories/GHSA-8hf8-8gvw-ggvx; https://github.com/envoyproxy/envoy/commits/master
CVE: CVE-2020-12605
Published: 2020-07-01
Description: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/envoyproxy/envoy-setec/issues/137; https://github.com/envoyproxy/envoy/security/advisories/GHSA-fjxc-jj43-f777; https://github.com/envoyproxy/envoy-setec/issues/137
CVE: CVE-2020-13380
Published: 2020-07-01
Description: openSIS before 7.4 allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8; https://packetstormsecurity.com/files/158257/openSIS-7.4-SQL-Injection.html; https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8
CVE: CVE-2020-13381
Published: 2020-07-01
Description: openSIS through 7.4 allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.html; https://github.com/OS4ED/openSIS-Responsive-Design/commits/master; https://packetstormsecurity.com/files/158257/openSIS-7.4-SQL-Injection.html
CVE: CVE-2020-13382
Published: 2020-07-01
Description: openSIS through 7.4 has Incorrect Access Control.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: http://packetstormsecurity.com/files/158255/openSIS-7.4-Incorrect-Access-Control.html; http://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.html; https://github.com/OS4ED/openSIS-Responsive-Design/commits/master
CVE: CVE-2020-13383
Published: 2020-07-01
Description: openSIS through 7.4 allows Directory Traversal.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/158256/openSIS-7.4-Local-File-Inclusion.html; http://packetstormsecurity.com/files/158331/openSIS-7.4-Unauthenticated-PHP-Code-Execution.html; https://github.com/OS4ED/openSIS-Responsive-Design/commit/1127ae0bb7c3a2883febeabc6b71ad8d73510de8