deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-27211
Published: 2021-02-15
Description: steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-335
References: http://packetstormsecurity.com/files/165199/Steghide-Hidden-Data-Extraction.html; https://github.com/StefanoDeVuono/steghide; https://github.com/b4shfire/stegcrack
CVE: CVE-2020-28337
Published: 2021-02-15
Description: A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/162514/Microweber-CMS-1.1.20-Remote-Code-Execution.html; https://github.com/microweber/microweber/commit/777ee9c3e7519eb3672c79ac41066175b2001b50; https://sl1nki.page/advisories/CVE-2020-28337
CVE: CVE-2020-29142
Published: 2021-02-15
Description: A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule_facility parameter when restrict_user_facility=on is in global settings.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732; https://murat.one/?p=90; https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035
CVE: CVE-2020-29139
Published: 2021-02-15
Description: A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732; https://murat.one/?p=70; https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035
CVE: CVE-2020-29140
Published: 2021-02-15
Description: A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732; https://murat.one/?p=86; https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035
CVE: CVE-2020-29143
Published: 2021-02-15
Description: A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://community.open-emr.org/t/openemr-6-0-0-has-been-released/15732; https://murat.one/?p=94; https://nitroteam.kz/index.php?action=researches&slug=OpenEMR--9035
CVE: CVE-2020-35500
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-35734
Published: 2021-02-15
Description: Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: http://packetstormsecurity.com/files/161457/Batflat-CMS-1.3.6-Remote-Code-Execution.html; https://batflat.org/en/changelog; https://github.com/sruupl/batflat/issues/98
CVE: CVE-2021-26200
Published: 2021-02-15
Description: The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49462; https://www.exploit-db.com/exploits/49462
CVE: CVE-2021-26201
Published: 2021-02-15
Description: The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. An attacker can obtain access to the admin panel by injecting a SQL query in the username field of the login page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49463; https://www.exploit-db.com/exploits/49463
CVE: CVE-2021-26822
Published: 2021-02-15
Description: Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. This vulnerability can be exploited by a remote unauthenticated attacker to leak sensitive information and perform code execution attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26822; https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/; https://www.exploit-db.com/exploits/49562
CVE: CVE-2021-3239
Published: 2021-02-15
Description: E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TCSWT/E-Learning-System/blob/main/README.md; https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/janobe/CVE-nu11-101821; https://packetstormsecurity.com/files/160966/E-Learning-System-1.0-SQL-Injection-Shell-Upload.html
CVE: CVE-2020-1966
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-1969
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-1970
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-1972
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-1973
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-1974
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-35617
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-35618
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-35619
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-35620
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-35621
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3813
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3814
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3815
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3816
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3817
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3818
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3819
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3820
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3821
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3822
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3823
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2020-3824
Published: 2021-02-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2020. Notes: none
CVE: CVE-2021-21511
Published: 2021-02-15
Description: Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. A remote low privileged attacker could potentially exploit this vulnerability, to gain unauthorized read or modification access to other users' backup data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://www.dell.com/support/kbdoc/en-us/000182926/dsa-2021-033-dell-emc-avamar-server-improper-authorization-vulnerability; https://www.dell.com/support/kbdoc/en-us/000182926/dsa-2021-033-dell-emc-avamar-server-improper-authorization-vulnerability
CVE: CVE-2021-27229
Published: 2021-02-16
Description: Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://github.com/mumble-voip/mumble/commit/e59ee87abe249f345908c7d568f6879d16bfd648; https://github.com/mumble-voip/mumble/compare/1.3.3...1.3.4; https://github.com/mumble-voip/mumble/pull/4733
CVE: CVE-2021-27231
Published: 2021-02-16
Description: Hestia Control Panel 1.3.5 and below, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer's domain name, leading to spoofing of services or email messages.
CVSS Score: 5.4 (MEDIUM)
References: https://github.com/hestiacp/hestiacp/issues/1622; https://github.com/sickcodes/security/blob/master/advisories/sick-2021-006.md; https://sick.codes/sick-2021-006
CVE: CVE-2021-27233
Published: 2021-02-16
Description: An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-312
References: https://www.mutare.com/security-adv-mutare-2021-004-mutare-voice/; https://www.mutare.com/security-adv-mutare-2021-004-mutare-voice/
CVE: CVE-2021-27234
Published: 2021-02-16
Description: An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. The web application suffers from SQL injection on Adminlog.asp, Archivemsgs.asp, Deletelog.asp, Eventlog.asp, and Evmlog.asp.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.mutare.com/security-adv-mutare-2021-002-mutare-voice/; https://www.mutare.com/security-adv-mutare-2021-002-mutare-voice/
CVE: CVE-2021-27235
Published: 2021-02-16
Description: An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diagzip.asp that allows anyone to export tables of a database.
CVSS Score: 4.9 (MEDIUM)
References: https://www.mutare.com/security-adv-mutare-2021-003-mutare-voice/; https://www.mutare.com/security-adv-mutare-2021-003-mutare-voice/
CVE: CVE-2021-27236
Published: 2021-02-16
Description: An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668
References: https://www.mutare.com/security-adv-mutare-2021-001-mutare-voice/; https://www.mutare.com/security-adv-mutare-2021-001-mutare-voice/
CVE: CVE-2020-24841
Published: 2021-02-16
Description: PNPSCADA 2[PII_REDACTED]20 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://sdg.com; https://www.exploit-db.com/exploits/48757; http://sdg.com
CVE: CVE-2020-25340
Published: 2021-02-16
Description: An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (DoS).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://github.com/ntop/nDPI/issues/994; https://github.com/ntop/nDPI/issues/994
CVE: CVE-2021-25648
Published: 2021-02-16
Description: Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters "isAdmin" and "isPremium" located on device storage.
CVSS Score: 9.8 (CRITICAL)
References: https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation/; https://vrls.ws/posts/2021/02/cve-2021-25648-mobile-application-testes-de-codigo-privilege-escalation/
CVE: CVE-2021-27232
Published: 2021-02-16
Description: The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage using Internet Explorer where the exploit could be triggered.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server-RSTPLive555%20Activex%20Buffer%20overflow.txt; https://support.pelco.com/s/article/What-is-the-Digital-Sentry-software-release-revision-history; https://github.com/vitorespf/Advisories/blob/master/Pelco_Digital_Sentry_Server-RSTPLive555%20Activex%20Buffer%20overflow.txt
CVE: CVE-2020-29022
Published: 2021-02-16
Description: Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-159
References: https://www.secomea.com/support/cybersecurity-advisory/#2923; https://www.secomea.com/support/cybersecurity-advisory/#2923
CVE: CVE-2020-29023
Published: 2021-02-16
Description: Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may run arbitrary commands on a victim's computer when opened in a spreadsheet program (like Excel). This issue affects: Secomea GateManager all versions prior to 9.3.
CVSS Score: 3.5 (LOW)
CWE: CWE-116, CWE-116
References: https://www.secomea.com/support/cybersecurity-advisory/; https://www.secomea.com/support/cybersecurity-advisory/#2418; https://www.secomea.com/support/cybersecurity-advisory/
CVE: CVE-2020-29024
Published: 2021-02-16
Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prior to 9.3.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-614, CWE-311
References: https://www.secomea.com/support/cybersecurity-advisory/#2418; https://www.secomea.com/support/cybersecurity-advisory/#2418
CVE: CVE-2020-29025
Published: 2021-02-16
Description: A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.secomea.com/support/cybersecurity-advisory/#3042; https://www.secomea.com/support/cybersecurity-advisory/#3042
CVE: CVE-2020-29027
Published: 2021-02-16
Description: Cross-site Scripting (XSS) vulnerability in GUI of Secomea SiteManager could allow an attacker to cause an XSS Attack. This issue affects: Secomea SiteManager all versions prior to 9.3.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.secomea.com/support/cybersecurity-advisory/#3042; https://www.secomea.com/support/cybersecurity-advisory/#3042
CVE: CVE-2020-35557
Published: 2021-02-16
Description: An issue in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 allows a logged in user to see devices in the account he should not have access to due to improper use of access validation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://cert.vde.com/en/advisories/VDE-2021-003; https://cert.vde.com/en/advisories/VDE-2022-039; https://mbconnectline.com/security-advice/
CVE: CVE-2020-35558
Published: 2021-02-16
Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual through 2.11.2. There is an SSRF in the in the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://cert.vde.com/en/advisories/VDE-2021-003; https://cert.vde.com/en/advisories/VDE-2022-039; https://mbconnectline.com/security-advice/
CVE: CVE-2020-35559
Published: 2021-02-16
Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://mbconnectline.com/security-advice/; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-35560
Published: 2021-02-16
Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://mbconnectline.com/security-advice/; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-35561
Published: 2021-02-16
Description: An issue was discovered MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://cert.vde.com/en/advisories/VDE-2021-003; https://cert.vde.com/en/advisories/VDE-2022-039; https://mbconnectline.com/security-advice/
CVE: CVE-2020-35563
Published: 2021-02-16
Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into the page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://mbconnectline.com/security-advice/; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-35564
Published: 2021-02-16
Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://mbconnectline.com/security-advice/; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-35565
Published: 2021-02-16
Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://mbconnectline.com/security-advice/; https://cert.vde.com/de-de/advisories/vde-2021-003
CVE: CVE-2020-35566
Published: 2021-02-16
Description: An issue was discovered in MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2. An attacker can read arbitrary JSON files via Local File Inclusion.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-706
References: https://cert.vde.com/en/advisories/VDE-2021-003; https://cert.vde.com/en/advisories/VDE-2022-039; https://mbconnectline.com/security-advice/
CVE: CVE-2020-35567
Published: 2021-02-16
Description: An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across instances.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://cert.vde.com/de-de/advisories/vde-2021-003; https://mbconnectline.com/security-advice/; https://cert.vde.com/de-de/advisories/vde-2021-003