deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-7616
Published: 2020-04-07
Description: express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/LingyuCoder/express-mock-middleware/blob/master/lib/index.js#L39; https://snyk.io/vuln/SNYK-JS-EXPRESSMOCKMIDDLEWARE-564120; https://github.com/LingyuCoder/express-mock-middleware/blob/master/lib/index.js#L39
CVE: CVE-2020-7618
Published: 2020-04-07
Description: sds through 3.2.0 is vulnerable to Prototype Pollution.The library could be tricked into adding or modifying properties of the 'Object.prototype' by abusing the 'set' function located in 'js/set.js'.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/monsterkodi/sds/blob/master/js/set.js#L31; https://snyk.io/vuln/SNYK-JS-SDS-564123; https://github.com/monsterkodi/sds/blob/master/js/set.js#L31
CVE: CVE-2017-18647
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6,x) and N(7.0) software. The TA Scrypto v1.0 implementation in Secure Driver has a race condition with a resultant buffer overflow. The Samsung IDs are SVE-2017-8973, SVE-2017-8974, and SVE-2017-8975 (November 2017).
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18648
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4.x), L(5.x), M(6.x), and N(7.x) software. Arbitrary file read/write operations can occur in the locked state via a crafted MTP command. The Samsung ID is SVE-2017-10086 (November 2017).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18649
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can boot a device with root privileges because the bootloader for the Qualcomm MSM8998 chipset lacks an integrity check of the system image, aka the "SamFAIL" issue. The Samsung ID is SVE-2017-10465 (November 2017).
CVSS Score: 7.2 (HIGH)
CWE: CWE-354
References: https://androidcommunity.com/samfail-method-gives-root-access-to-samsung-galaxy-note-8-snapdragon-variant-20171009/; https://security.samsungmobile.com/securityUpdate.smsb; https://androidcommunity.com/samfail-method-gives-root-access-to-samsung-galaxy-note-8-snapdragon-variant-20171009/
CVE: CVE-2017-18650
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with N(7.x) software. There is a WifiStateMachine IllegalArgumentException and reboot if a malformed wpa_supplicant.conf is read. The Samsung ID is SVE-2017-9828 (October 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-754
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18651
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. There is an Integer Overflow in process_M_SetTokenTUIPasswd during handling of a trusted application, leading to memory corruption. The Samsung IDs are SVE-2017-9008 and SVE-2017-9009 (October 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18652
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. SVoice allows arbitrary code execution by changing dynamic libraries. The Samsung ID is SVE-2017-9299 (September 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18653
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. The Email application allows attackers to send emails on behalf of any user via a broadcasted intent. The Samsung ID is SVE-2017-9357 (September 2017).
CVSS Score: 4.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18654
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0, 7.1) software. An unauthenticated attacker can register a new security certificate. The Samsung ID is SVE-2017-9659 (September 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18655
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a stack-based buffer overflow with resultant memory corruption in a trustlet. The Samsung IDs are SVE-2017-8889, SVE-2017-8891, and SVE-2017-8892 (August 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18656
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer over-read in a trustlet. The Samsung ID is SVE-2017-8890 (August 2017).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18657
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is an arbitrary write in a trustlet. The Samsung ID is SVE-2017-8893 (August 2017).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18658
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. The multiwindow_facade API allows attackers to cause a NullPointerException and system halt via an attempted screen touch of a non-existing display. The Samsung ID is SVE-2017-9383 (August 2017).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18659
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. Attackers can crash system processes via a broadcast to AdaptiveDisplayColorService. The Samsung ID is SVE-2017-8290 (July 2017).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18660
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer overflow in tlc_server. The Samsung ID is SVE-2017-8888 (July 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18661
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. There is a buffer overflow in process_cipher_tdea. The Samsung ID is SVE-2017-8973 (July 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18662
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. Data outside of the rkp log buffer boundary is read, causing an information leak. The Samsung ID is SVE-2017-9109 (July 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18663
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with N(7.x) software. Because of missing Intent exception handling, system_server can have a NullPointerException with a crash of a system process. The Samsung IDs are SVE-2017-9122, SVE-2017-9123, SVE-2017-9124, and SVE-2017-9126 (July 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18664
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. There is a NULL pointer exception in PersonManager, causing memory corruption. The Samsung ID is SVE-2017-8286 (June 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18665
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. There is a NULL pointer exception in WifiService via adb-cmd, causing memory corruption. The Samsung ID is SVE-2017-8287 (June 2017).
CVSS Score: 8.8 (HIGH)
CWE: CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18666
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. Applications can send arbitrary premium SMS messages. The Samsung ID is SVE-2017-8701 (June 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18667
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. Attackers can prevent users from learning that SMS storage space has been exhausted. The Samsung ID is SVE-2017-8702 (June 2017).
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18668
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. Attackers can prevent users from making outbound calls and sending outbound text messages. The Samsung ID is SVE-2017-8706 (June 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18669
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with N(7.x) software. Persona has an unprotected API that allows launch of any activity with system privileges. The Samsung ID is SVE-2017-9000 (June 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18670
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. android.intent.action.SIOP_LEVEL_CHANGED allows a serializable intent reboot. The Samsung ID is SVE-2017-8363 (May 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18671
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software. Intents related to Wi-Fi have incorrect exception handling, leading to a crash of system processes. The Samsung ID is SVE-2017-8389 (May 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18672
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1), M(6.0), and N(7.x) software. Because of incorrect exception handling for Intents, a local attacker can force a reboot within framework.jar. The Samsung ID is SVE-2017-8390 (May 2017).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18673
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with N(7.x) software. An attacker can disable the Location service on a locked device, making it impossible for the rightful owner to find a stolen device. The Samsung ID is SVE-2017-8524 (May 2017).
CVSS Score: 2.4 (LOW)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18674
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with N(7.0) software. The time service (aka Timaservice) allows a kernel panic. The Samsung ID is SVE-2017-8593 (May 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18675
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) (Exynos7420 or Exynox8890 chipsets) software. The Camera application can leak uninitialized memory via ion. The Samsung ID is SVE-2016-6989 (April 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18676
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm chipsets) software. There is an RKP kernel protection bypass (in which unwanted memory mappings may occur) because of a lack of MSR trapping. The Samsung ID is SVE-2016-7901 (April 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18677
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. Because of an unprotected Intent, an attacker can reset the configuration of certain applications. The Samsung ID is SVE-2016-7142 (April 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18678
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.x) software. An attacker can crash system processes via a Serializable object because of missing exception handling. The Samsung IDs are SVE-2017-8109, SVE-2017-8110, SVE-2017-8115, SVE-2017-8118, and SVE-2017-8119 (April 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18679
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. SLocation can cause a system crash via a call to an API that is not implemented. The Samsung ID is SVE-2017-8285 (April 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18680
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (tablets) software. The lockscreen interface allows Add User actions, leading to an unintended ability to access user data in external storage. The Samsung ID is SVE-2016-7797 (March 2017).
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18681
Published: 2020-04-07
Description: An issue was discovered on Samsung Galaxy S5 mobile devices with software through 2016-12-20 (Qualcomm AP chipsets). There are multiple buffer overflows in the bootloader. The Samsung ID is SVE-2016-7930 (March 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18682
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Because of incorrect exception handling and an unprotected intent, AudioService can cause a system crash, The Samsung IDs are SVE-2017-8114, SVE-2017-8116, and SVE-2017-8117 (March 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18683
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows Hare Hunting during application installation. The Samsung ID is SVE-2016-6942 (February 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18684
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) software. SVoice allows provider seizure via an application that uses a custom provider. The Samsung ID is SVE-2016-6942 (February 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18685
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), and M(6.0) software. The InputMethod application can cause a system crash via a malformed serializable object in an Intent. The Samsung ID is SVE-2016-7123 (February 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18686
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) software. Contact information can leak to a log file because of the broadcasting of an unprotected intent. The Samsung ID is SVE-2016-7180 (February 2017).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18687
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. An attacker can obtain the full pathnames of sdcard files by reading the system protected log upon reception of a certain intent. The Samsung ID is SVE-2016-7183 (January 2017).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18688
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with L(5.1), M(6.0), and N(7.0) software. There is an information disclosure (of memory locations outside a buffer) via /dev/dsm_ctrl_dev. The Samsung ID is SVE-2016-7340 (January 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18689
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos5433, Exynos7420, or Exynos7870 chipsets) software. An attacker can bypass a ko (aka Kernel Module) signature by modifying the count of kernel modules. The Samsung ID is SVE-2016-7466 (January 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-354
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18690
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) (Exynos54xx, Exynos7420, Exynos8890, or Exynos8895 chipsets) software. There is a buffer overflow in the sensor hub. The Samsung ID is SVE-2016-7484 (January 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18691
Published: 2020-04-07
Description: An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (Exynos8890 chipsets) software. There are multiple Buffer Overflows in TSP sysfs cmd_store. The Samsung ID is SVE-2016-7500 (January 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-4391
Published: 2020-04-07
Description: HCL AppScan Standard is vulnerable to XML External Entity Injection (XXE) attack when processing XML data
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0077917; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0077917
CVE: CVE-2019-4393
Published: 2020-04-07
Description: HCL AppScan Standard is vulnerable to excessive authorization attempts
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0077916; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0077916
CVE: CVE-2020-11561
Published: 2020-04-07
Description: In NCH Express Invoice 7.25, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as the "Add New Item" screen.
CVSS Score: 8.8 (HIGH)
CWE: CWE-425
References: https://tejaspingulkar.blogspot.com; https://tejaspingulkar.blogspot.com/2020/03/cve-cve-2020-11561-title-escalation-via.html; https://youtu.be/-i2KtBgO3Kw
CVE: CVE-2020-5302
Published: 2020-04-07
Description: MH-WikiBot (an IRC Bot for interacting with the Miraheze API), had a bug that allowed any unprivileged user to access the steward commands on the IRC interface by impersonating the Nickname used by a privileged user as no check was made to see if they were logged in. The issue has been fixed in commit 23d9d5b0a59667a5d6816fdabb960b537a5f9ed1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-284, CWE-269
References: https://github.com/examknow/MH-WikiBot/compare/2eac90d...1a62da1; https://github.com/examknow/MH-WikiBot/security/advisories/GHSA-7hf3-wvp8-34r9; https://github.com/examknow/MH-WikiBot/compare/2eac90d...1a62da1
CVE: CVE-2020-11512
Published: 2020-04-07
Description: Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter, which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wordpress.org/plugins/idx-broker-platinum/#developers; https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-impress-for-idx-broker/; https://wordpress.org/plugins/idx-broker-platinum/#developers