deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6771
Published: 2021-03-25
Description: Loading a DLL through an Uncontrolled Search Path Element in Bosch IP Helper up to and including version 1.00.0008 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same application directory as the portable IP Helper application.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
CVE: CVE-2020-6785
Published: 2021-03-25
Description: Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allows an attacker to execute arbitrary code on a victim's system. This affects both the installer as well as the installed application. This also affects Bosch DIVAR IP 7000 R2, Bosch DIVAR IP all-in-one 5000 and Bosch DIVAR IP all-in-one 7000 with installers and installed BVMS versions prior to BVMS 10.1.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
CVE: CVE-2020-6786
Published: 2021-03-25
Description: Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
CVE: CVE-2020-6787
Published: 2021-03-25
Description: Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
CVE: CVE-2020-6788
Published: 2021-03-25
Description: Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
CVE: CVE-2020-6789
Published: 2021-03-25
Description: Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same directory where the installer is started from.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
CVE: CVE-2020-6790
Published: 2021-03-25
Description: Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious exe in the same directory where the installer is started from.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html; https://psirt.bosch.com/security-advisories/bosch-sa-835563-bt.html
CVE: CVE-2021-22496
Published: 2021-03-25
Description: Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. The vulnerability could cause information leakage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://www.netiq.com/documentation/access-manager-45-appliance/accessmanager453-p3-release-notes/data/accessmanager453-p3-release-notes.html; https://www.netiq.com/documentation/access-manager-45-appliance/accessmanager453-p3-release-notes/data/accessmanager453-p3-release-notes.html
CVE: CVE-2021-22659
Published: 2021-03-25
Description: Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user.
CVSS Score: 8.6 (HIGH)
CWE: CWE-120
References: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129877/loc/en_US#__highlight; https://us-cert.cisa.gov/ics/advisories/icsa-21-033-01; https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129877/loc/en_US#__highlight
CVE: CVE-2021-21783
Published: 2021-03-25
Description: A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-680, CWE-190
References: https://talosintelligence.com/vulnerability_reports/TALOS-2021-1245; https://www.oracle.com/security-alerts/cpujan2022.html; https://www.oracle.com/security-alerts/cpuoct2021.html
CVE: CVE-2021-25349
Published: 2021-03-25
Description: Using unsafe PendingIntent in Slow Motion Editor prior to version 3.5.18.5 allows local attackers unauthorized action without permission via hijacking the PendingIntent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25350
Published: 2021-03-25
Description: Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log.
CVSS Score: 2.0 (LOW)
CWE: CWE-200, CWE-532
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25351
Published: 2021-03-25
Description: Improper Access Control in EmailValidationView in Samsung Account prior to version 10.7.0.7 and 12.1.1.3 allows physically proximate attackers to log out user account on device without user password.
CVSS Score: 3.2 (LOW)
CWE: CWE-285
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25352
Published: 2021-03-25
Description: Using PendingIntent with implicit intent in Bixby Voice prior to version 3.0.52.14 allows attackers to execute privileged action by hijacking and modifying the intent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285, CWE-668
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25353
Published: 2021-03-25
Description: Using empty PendingIntent in Galaxy Themes prior to version 5.2.00.1215 allows local attackers to read/write private file directories of Galaxy Themes application without permission via hijacking the PendingIntent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25354
Published: 2021-03-25
Description: Improper input check in Samsung Internet prior to version 13.2.1.46 allows attackers to launch non-exported activity in Samsung Browser via malicious deeplink.
CVSS Score: 3.3 (LOW)
CWE: CWE-285
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25355
Published: 2021-03-25
Description: Using unsafe PendingIntent in Samsung Notes prior to version 4.2.00.22 allows local attackers unauthorized action without permission via hijacking the PendingIntent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285, CWE-276
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25366
Published: 2021-03-25
Description: Improper access control in Samsung Internet prior to version 13.2.1.70 allows physically proximate attackers to bypass the secret mode's authentication.
CVSS Score: 3.2 (LOW)
CWE: CWE-703
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25367
Published: 2021-03-25
Description: Path Traversal vulnerability in Samsung Notes prior to version 4.2.00.22 allows attackers to access local files without permission.
CVSS Score: 3.7 (LOW)
CWE: CWE-22, CWE-22
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2021-25368
Published: 2021-03-25
Description: Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed.
CVSS Score: 3.3 (LOW)
CWE: CWE-287, CWE-287
References: https://security.samsungmobile.com/; https://security.samsungmobile.com/serviceWeb.smsb; https://security.samsungmobile.com/
CVE: CVE-2020-35502
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.29. Memory leaks when a response is buffered and the buffer limit is reached or Privoxy is running out of memory can lead to a system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928749; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
CVE: CVE-2021-20210
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.29. Memory leak in the show-status CGI handler when no filter files are configured can lead to a system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928729; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
CVE: CVE-2021-20211
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.29. Memory leak when client tags are active can cause a system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928733; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
CVE: CVE-2021-20212
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.29. Memory leak if multiple filters are executed and the last one is skipped due to a pcre error leading to a system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928736; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
CVE: CVE-2021-20213
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.29. Dereference of a NULL-pointer that could result in a crash if accept-intercepted-requests was enabled, Privoxy failed to get the request destination from the Host header and a memory allocation failed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928739; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
CVE: CVE-2021-20214
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the client-tags CGI handler when client tags are configured and memory allocations fail can lead to a system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928742; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
CVE: CVE-2021-20215
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.29. Memory leaks in the show-status CGI handler when memory allocations fail can lead to a system crash.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1928746; https://security.gentoo.org/glsa/202107-16; https://www.privoxy.org/3.0.29/user-manual/whatsnew.html
CVE: CVE-2021-20216
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.31. A memory leak that occurs when decompression fails unexpectedly may lead to a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-401
References: https://bugzilla.redhat.com/show_bug.cgi?id=1923256; https://security.gentoo.org/glsa/202107-16; https://www.openwall.com/lists/oss-security/2021/01/31/2
CVE: CVE-2021-20217
Published: 2021-03-25
Description: A flaw was found in Privoxy in versions before 3.0.31. An assertion failure triggered by a crafted CGI request may lead to denial of service. The highest threat from this vulnerability is to system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://bugzilla.redhat.com/show_bug.cgi?id=1923252; https://security.gentoo.org/glsa/202107-16; https://bugzilla.redhat.com/show_bug.cgi?id=1923252
CVE: CVE-2021-26596
Published: 2021-03-25
Description: An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.gruppotim.it/redteam; https://www.trusted-introducer.org/directory/teams/nokia-psirt.html; https://www.gruppotim.it/redteam
CVE: CVE-2021-26597
Published: 2021-03-25
Description: An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the Site Configuration Tool web site section and arbitrarily upload potentially dangerous files without restrictions via the /netact/sct dir parameter in conjunction with the operation=upload value.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://www.gruppotim.it/redteam; https://www.trusted-introducer.org/directory/teams/nokia-psirt.html; https://www.gruppotim.it/redteam
CVE: CVE-2021-27192
Published: 2021-03-25
Description: Local privilege escalation vulnerability in Windows clients of Netop Vision Pro up to and including 9.7.1 allows a local user to gain administrator privileges whilst using the clients.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight; https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight
CVE: CVE-2021-27193
Published: 2021-03-25
Description: Incorrect default permissions vulnerability in the API of Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to read and write files on the remote machine with system privileges resulting in a privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight; https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight
CVE: CVE-2021-27194
Published: 2021-03-25
Description: Cleartext transmission of sensitive information in Netop Vision Pro up to and including 9.7.1 allows a remote unauthenticated attacker to gather credentials including Windows login usernames and passwords.
CVSS Score: 8.8 (HIGH)
CWE: CWE-319
References: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight; https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight
CVE: CVE-2021-27195
Published: 2021-03-25
Description: Improper Authorization vulnerability in Netop Vision Pro up to and including to 9.7.1 allows an attacker to replay network traffic.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-863
References: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight; https://www.mcafee.com/blogs/other-blogs/mcafee-labs/netop-vision-pro-distance-learning-software-is-20-20-in-hindsight
CVE: CVE-2021-29096
Published: 2021-03-25
Description: A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader, ArcGIS Desktop, ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/; https://www.zerodayinitiative.com/advisories/ZDI-21-370/; https://www.esri.com/arcgis-blog/products/arcgis/administration/security-advisory-general-raster/
CVE: CVE-2021-3443
Published: 2021-03-25
Description: A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939233; https://bugzilla.redhat.com/show_bug.cgi?id=1939233
CVE: CVE-2021-3446
Published: 2021-03-25
Description: A flaw was found in libtpms in versions before 0.8.2. The commonly used integration of libtpms with OpenSSL contained a vulnerability related to the returned IV (initialization vector) when certain symmetric ciphers were used. Instead of returning the last IV it returned the initial IV to the caller, thus weakening the subsequent encryption and decryption steps. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-327, CWE-330
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939664; https://bugzilla.redhat.com/show_bug.cgi?id=1939664
CVE: CVE-2021-3466
Published: 2021-03-25
Description: A flaw was found in libmicrohttpd. A missing bounds check in the post_process_urlencoded function leads to a buffer overflow, allowing a remote attacker to write arbitrary data in an application that uses libmicrohttpd. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Only version 0.9.70 is vulnerable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://bugzilla.redhat.com/show_bug.cgi?id=1939127; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4334XJNDJPYQNFE6S3S2KUJJ7TMHYCWL/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/75HDMREKITMGPGE62NP7KE62ZJVLETXN/
CVE: CVE-2021-3467
Published: 2021-03-25
Description: A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1942097; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KWAIUFNIUCGS2IMGGDTWZIUIY7BNLGKF/; https://bugzilla.redhat.com/show_bug.cgi?id=1942097
CVE: CVE-2020-10579
Published: 2021-03-25
Description: A directory traversal on the /admin/sysmon.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to list the content of arbitrary server directories accessible to the user running the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf; https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf
CVE: CVE-2020-10580
Published: 2021-03-25
Description: A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary PHP code on the server as the user running the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://cwe.mitre.org/data/definitions/77.html; https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf; https://cwe.mitre.org/data/definitions/77.html
CVE: CVE-2020-10581
Published: 2021-03-25
Description: Multiple session validity check issues in several administration functionalities of Invigo Automatic Device Management (ADM) through 5.0 allow remote attackers to read potentially sensitive data hosted by the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668
References: https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf; https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf
CVE: CVE-2020-10582
Published: 2021-03-25
Description: A SQL injection on the /admin/display_errors.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to execute arbitrary SQL requests (including data reading and modification) on the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf; https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf
CVE: CVE-2020-10583
Published: 2021-03-25
Description: The /admin/admapi.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on the server as the user running the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf; https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf
CVE: CVE-2020-10584
Published: 2021-03-25
Description: A directory traversal on the /admin/search_by.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote attackers to read arbitrary server files accessible to the user running the application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf; https://www.on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf