deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5278
Published: 2020-04-20
Description: In PrestaShop between versions 1.5.4.0 and 1.7.6.5, there is a reflected XSS on Exception page The problem is fixed in 1.7.6.5
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/PrestaShop/commit/ea85210d6e5d81f058b55764bc4608cdb0b36c5d; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mrpj-67mq-3fr5; https://github.com/PrestaShop/PrestaShop/commit/ea85210d6e5d81f058b55764bc4608cdb0b36c5d
CVE: CVE-2020-5279
Published: 2020-04-20
Description: In PrestaShop between versions 1.5.0.0 and 1.7.6.5, there are improper access control since the the version 1.5.0.0 for legacy controllers. - admin-dev/index.php/configure/shop/customer-preferences/ - admin-dev/index.php/improve/international/translations/ - admin-dev/index.php/improve/international/geolocation/ - admin-dev/index.php/improve/international/localization - admin-dev/index.php/configure/advanced/performance - admin-dev/index.php/sell/orders/delivery-slips/ - admin-dev/index.php?controller=AdminStatuses The problem is fixed in 1.7.6.5
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/PrestaShop/PrestaShop/commit/4444fb85761667a2206874a3112ccc77f657d76a; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-74vp-ww64-w2gm; https://github.com/PrestaShop/PrestaShop/commit/4444fb85761667a2206874a3112ccc77f657d76a
CVE: CVE-2020-5285
Published: 2020-04-20
Description: In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/PrestaShop/commit/b6aea152988d81e1586f1c03f2e72c9ef2fe7df7; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-j3r6-33hf-m8wh; https://github.com/PrestaShop/PrestaShop/commit/b6aea152988d81e1586f1c03f2e72c9ef2fe7df7
CVE: CVE-2020-5286
Published: 2020-04-20
Description: In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/PrestaShop/commit/fc0625fb0a9aab1835515f1bea52e8e063384da7; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-98j8-hvjv-x47j; https://github.com/PrestaShop/PrestaShop/commit/fc0625fb0a9aab1835515f1bea52e8e063384da7
CVE: CVE-2020-5287
Published: 2020-04-20
Description: In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/PrestaShop/PrestaShop/commit/27e49d89808f1d76eb909a595f344a6739bc0b52; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-r6rp-6gv6-r9hq; https://github.com/PrestaShop/PrestaShop/commit/27e49d89808f1d76eb909a595f344a6739bc0b52
CVE: CVE-2020-5288
Published: 2020-04-20
Description: "In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1.7.6.5.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/PrestaShop/PrestaShop/commit/fc1d796dda769efdbc4d9e02ea7a11e4167338d0; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-4wxg-33h3-3w5r; https://github.com/PrestaShop/PrestaShop/commit/fc1d796dda769efdbc4d9e02ea7a11e4167338d0
CVE: CVE-2020-5293
Published: 2020-04-20
Description: In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and specific prices. The problem is fixed in 1.7.6.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://github.com/PrestaShop/PrestaShop/commit/f9f442c87755908e23a6bcba8c443cdea1d78a7f; https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-cvjj-grfv-f56w; https://github.com/PrestaShop/PrestaShop/commit/f9f442c87755908e23a6bcba8c443cdea1d78a7f
CVE: CVE-2020-11753
Published: 2020-04-20
Description: An issue was discovered in Sonatype Nexus Repository Manager in versions 3.21.1 and 3.22.0. It is possible for a user with appropriate privileges to create, modify, and execute scripting tasks without use of the UI or API. NOTE: in 3.22.0, scripting is disabled by default (making this not exploitable).
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://cwe.mitre.org/data/definitions/284.html; https://support.sonatype.com/hc/en-us/articles/[PII_REDACTED]14; https://cwe.mitre.org/data/definitions/284.html
CVE: CVE-2019-10148
Published: 2020-04-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2019-12779. Reason: This candidate is a reservation duplicate of CVE-2019-12779. Notes: All CVE users should reference CVE- CVE-2019-12779 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-10935
Published: 2020-04-20
Description: Zulip Server before 2.1.3 allows XSS via a Markdown link, with resultant account takeover.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/; https://www.coresecurity.com/advisories/zulip-account-takeover-stored-xss; https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/
CVE: CVE-2020-1803
Published: 2020-04-20
Description: Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier than 10.0.0.180(C432E10R3P4) have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, successful exploit could cause information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-smartphone-en
CVE: CVE-2020-3946
Published: 2020-04-20
Description: InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).
CVSS Score: 7.5 (HIGH)
CWE: CWE-776
References: https://blog.installbuilder.com/2019/12/configure-autoupdate-project-settings.html; https://blog.installbuilder.com/2019/12/configure-autoupdate-project-settings.html
CVE: CVE-2020-9070
Published: 2020-04-20
Description: Huawei smartphones Taurus-AL00B with versions earlier than 10.0.0.205(C00E201R7P2) have an improper authentication vulnerability. The software insufficiently validate the user's identity when a user wants to do certain operation. An attacker can trick user into installing a malicious application to exploit this vulnerability. Successful exploit may cause some information disclosure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-01-smartphone-en
CVE: CVE-2020-9444
Published: 2020-04-20
Description: Zulip Server before 2.1.3 allows reverse tabnabbing via the Markdown functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/; https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/
CVE: CVE-2020-9445
Published: 2020-04-20
Description: Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/; https://blog.zulip.org/2020/04/01/zulip-server-2-1-3-security-release/
CVE: CVE-2020-11946
Published: 2020-04-20
Description: Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://cwe.mitre.org/data/definitions/306.html; https://www.manageengine.com/network-monitoring/help/read-me-complete.html; https://cwe.mitre.org/data/definitions/306.html
CVE: CVE-2019-19108
Published: 2020-04-20
Description: An authentication weakness in the SNMP service in B&R Automation Runtime versions 2.96, 3.00, 3.01, 3.06 to 3.10, 4.00 to 4.63, 4.72 and above allows unauthenticated users to modify the configuration of B&R products via SNMP.
CVSS Score: 9.4 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/; https://www.us-cert.gov/ics/advisories/icsa-20-051-01; https://www.br-automation.com/en/downloads/012020-automation-runtime-snmp-authentication-weakness/
CVE: CVE-2020-11010
Published: 2020-04-20
Description: In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3; https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq; https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3
CVE: CVE-2020-11944
Published: 2020-04-20
Description: Abe (aka bitcoin-abe) through 0.7.2, and 0.8pre, allows XSS in __call__ in abe.py because the PATH_INFO environment variable is mishandled during a PageNotFound exception.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://geeknik-labs.com; https://github.com/bitcoin-abe/bitcoin-abe/blob/d33f6e85de74e708e11cabe4ed0246e12025c726/Abe/abe.py#L253-L254; https://github.com/bitcoin-abe/bitcoin-abe/issues/292
CVE: CVE-2020-9275
Published: 2020-04-20
Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A cfm UDP service listening on port 65002 allows remote, unauthenticated exfiltration of administrative credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://raelize.com/advisories/CVE-2020-9275_D-Link-DSL-2640B_Remote-Credentials-Exfiltration_v1.0.txt; https://raelize.com/posts/d-link-dsl-2640b-security-advisories/; https://www.dlink.com/en/security-bulletin
CVE: CVE-2020-9276
Published: 2020-04-20
Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The function do_cgi(), which processes cgi requests supplied to the device's web servers, is vulnerable to a remotely exploitable stack-based buffer overflow. Unauthenticated exploitation is possible by combining this vulnerability with CVE-2020-9277.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://raelize.com/advisories/CVE-2020-9276_D-Link-DSL-2640B_do_cgi-buffer-overflow_v1.0.txt; https://raelize.com/posts/d-link-dsl-2640b-security-advisories/; https://www.dlink.com/en/security-bulletin
CVE: CVE-2020-9277
Published: 2020-04-20
Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. Authentication can be bypassed when accessing cgi modules. This allows one to perform administrative tasks (e.g., modify the admin password) with no authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://raelize.com/advisories/CVE-2020-9277_D-Link-DSL-2640B_CGI-Authentication-bypass_v1.0.txt; https://raelize.com/posts/d-link-dsl-2640b-security-advisories/; https://www.dlink.com/en/security-bulletin
CVE: CVE-2020-9278
Published: 2020-04-20
Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. The device can be reset to its default configuration by accessing an unauthenticated URL.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://raelize.com/advisories/CVE-2020-9278_D-Link-DSL-2640B_Unauthenticated-configuration-reset_v1.0.txt; https://raelize.com/posts/d-link-dsl-2640b-security-advisories/; https://www.dlink.com/en/security-bulletin
CVE: CVE-2020-9279
Published: 2020-04-20
Description: An issue was discovered on D-Link DSL-2640B B2 EU_4.01B devices. A hard-coded account allows management-interface login with high privileges. The logged-in user can perform critical tasks and take full control of the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://raelize.com/advisories/CVE-2020-9279_D-Link-DSL-2640B_Hard-coded-privileged-account_v1.0.txt; https://raelize.com/posts/d-link-dsl-2640b-security-advisories/; https://www.dlink.com/en/security-bulletin
CVE: CVE-2020-11958
Published: 2020-04-21
Description: re2c 1.3 has a heap-based buffer overflow in Scanner::fill in parse/scanner.cc via a long lexeme.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2020/04/21/1; https://blogs.gentoo.org/ago/2020/04/19/re2c-heap-overflow-in-scannerfill-scanner-cc/; https://github.com/skvadrik/re2c/commit/c4603ba5ce229db83a2a4fb93e6d4b4e3ec3776a
CVE: CVE-2020-11963
Published: 2020-04-21
Description: IQrouter through 3.3.1, when unconfigured, has multiple remote code execution vulnerabilities in the web-panel because of Bash Shell Metacharacter Injection. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://evenroute.com/; https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-; https://openwrt.org/docs/guide-quick-start/walkthrough_login
CVE: CVE-2020-11964
Published: 2020-04-21
Description: In IQrouter through 3.3.1, the Lua function diag_set_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://evenroute.com/; https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-; https://openwrt.org/docs/guide-quick-start/walkthrough_login
CVE: CVE-2020-11965
Published: 2020-04-21
Description: In IQrouter through 3.3.1, there is a root user without a password, which allows attackers to gain full remote access via SSH. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://evenroute.com/; https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-; https://openwrt.org/docs/guide-quick-start/walkthrough_login
CVE: CVE-2020-11966
Published: 2020-04-21
Description: In IQrouter through 3.3.1, the Lua function reset_password in the web-panel allows remote attackers to change the root password arbitrarily. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://evenroute.com/; https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-; https://openwrt.org/docs/guide-quick-start/walkthrough_login
CVE: CVE-2020-11967
Published: 2020-04-21
Description: In IQrouter through 3.3.1, remote attackers can control the device (restart network, reboot, upgrade, reset) because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://evenroute.com/; https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-; https://openwrt.org/docs/guide-quick-start/walkthrough_login
CVE: CVE-2020-11968
Published: 2020-04-21
Description: In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced initial configuration (which has a required step for setting a secure password on the system), makes this CVE invalid. This vulnerability is “true for any unconfigured release of OpenWRT, and true of many other new Linux distros prior to being configured for the first time”
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://evenroute.com/; https://evenroute.zendesk.com/hc/en-us/articles/216107838-How-do-I-configure-an-IQrouter-; https://openwrt.org/docs/guide-quick-start/walkthrough_login
CVE: CVE-2020-8099
Published: 2020-04-21
Description: A vulnerability in the improper handling of junctions in Bitdefender Antivirus Free can allow an unprivileged user to substitute a quarantined file, and restore it to a privileged location. This issue affects: Bitdefender Antivirus Free versions prior to 1.0.17.
CVSS Score: 7.1 (HIGH)
CWE: CWE-59, CWE-59
References: https://www.bitdefender.com/support/security-advisories/link-resolution-privilege-escalation-vulnerability-in-bitdefender-antivirus-free-va-8387/; https://www.bitdefender.com/support/security-advisories/link-resolution-privilege-escalation-vulnerability-in-bitdefender-antivirus-free-va-8387/
CVE: CVE-2017-18821
Published: 2020-04-21
Description: Certain NETGEAR devices are affected by stored XSS. This affects M4300-28G before 12.0.2.15, M4300-52G before 12.0.2.15, M4300-28G-POE+ before 12.0.2.15, M4300-52G-POE+ before 12.0.2.15, M4300-8X8F before 12.0.2.15, M4300-12X12F before 12.0.2.15, M4300-24X24F before 12.0.2.15, M4300-24X before 12.0.2.15, M4300-48X before 12.0.2.15, and M4200 before 12.0.2.15.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000049044/Security-Advisory-for-Store-Cross-Site-Scripting-on-Some-Fully-Managed-Switches-PSV-2017-1948; https://kb.netgear.com/000049044/Security-Advisory-for-Store-Cross-Site-Scripting-on-Some-Fully-Managed-Switches-PSV-2017-1948
CVE: CVE-2020-11828
Published: 2020-04-21
Description: In ColorOS (oppo mobile phone operating system, based on AOSP frameworks/native code position/services/surfaceflinger surfaceflinger.CPP), RGB is defined on the stack but uninitialized, so when the screenShot function to RGB value assignment, will not initialize the value is returned to the attackers, leading to values on the stack information leakage, the vulnerability can be used to bypass attackers ALSR.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://security.oppo.com/cn/noticedetails.html?noticeId=[PII_REDACTED]8300033; https://security.oppo.com/cn/noticedetails.html?noticeId=[PII_REDACTED]8300033
CVE: CVE-2020-1967
Published: 2020-04-21
Description: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html; http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html
CVE: CVE-2020-8842
Published: 2020-04-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2017-18810
Published: 2020-04-21
Description: NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000049055/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0300; https://kb.netgear.com/000049055/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0300
CVE: CVE-2017-18811
Published: 2020-04-21
Description: NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000049054/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0299; https://kb.netgear.com/000049054/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0299
CVE: CVE-2017-18812
Published: 2020-04-21
Description: NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000049053/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0298; https://kb.netgear.com/000049053/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0298
CVE: CVE-2017-18813
Published: 2020-04-21
Description: NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000049052/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0296; https://kb.netgear.com/000049052/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-Devices-PSV-2017-0296
CVE: CVE-2017-18814
Published: 2020-04-21
Description: NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000049051/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-devices-PSV-2017-0295; https://kb.netgear.com/000049051/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-devices-PSV-2017-0295
CVE: CVE-2017-18815
Published: 2020-04-21
Description: NETGEAR ReadyNAS OS 6 devices, running ReadyNAS OS versions prior to 6.8.0 are affected by stored XSS.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000049050/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-devices-PSV-2017-0291; https://kb.netgear.com/000049050/Security-Advisory-for-Stored-Cross-Site-Scripting-Vulnerability-on-Some-ReadyNAS-devices-PSV-2017-0291