deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6531
Published: 2020-07-22
Description: Side-channel information leakage in scroll to text in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6533
Published: 2020-07-22
Description: Type Confusion in V8 in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6534
Published: 2020-07-22
Description: Heap buffer overflow in WebRTC in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6535
Published: 2020-07-22
Description: Insufficient data validation in WebUI in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2020-6536
Published: 2020-07-22
Description: Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox (URL bar) via a crafted PWA.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html
CVE: CVE-2014-1422
Published: 2020-07-22
Description: In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-275, CWE-732
References: https://bazaar.launchpad.net/~phablet-team/trust-store/trunk/revision/82; https://launchpad.net/bugs/1387734; https://bazaar.launchpad.net/~phablet-team/trust-store/trunk/revision/82
CVE: CVE-2020-15124
Published: 2020-07-22
Description: In Goobi Viewer Core before version 4.8.3, a path traversal vulnerability allows for remote attackers to access files on the server via the application. This is limited to files accessible to the application server user, eg. tomcat, but can potentially lead to the disclosure of sensitive information. The vulnerability has been fixed in version 4.8.3
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://github.com/intranda/goobi-viewer-core/commit/44ceb8e2e7e888391e8a941127171d6366770df3; https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-7gwq-xqw3-cr63; https://github.com/intranda/goobi-viewer-core/commit/44ceb8e2e7e888391e8a941127171d6366770df3
CVE: CVE-2020-15806
Published: 2020-07-22
Description: CODESYS Control runtime system before 3.5.16.10 allows Uncontrolled Memory Allocation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13199&token=3e283c3e73fed61f7c181a7fa1169477efaf0c58&download=; https://www.codesys.com; https://www.tenable.com/security/research/tra-2020-46
CVE: CVE-2020-15892
Published: 2020-07-22
Description: An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters. The problem is that validation is being done on the client side, hence it can be bypassed. When an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), to a larger length, the request will be forwarded to the webserver. This results in a stack-based buffer overflow. A few other POST variables, (transferred as part of the login request) are also vulnerable: html_response_page and log_user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-669, CWE-787
References: https://research.loginsoft.com/bugs/classic-stack-based-buffer-overflow-in-dlink-firmware-dap-1520/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169; https://research.loginsoft.com/bugs/classic-stack-based-buffer-overflow-in-dlink-firmware-dap-1520/
CVE: CVE-2020-15893
Published: 2020-07-22
Description: An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169; https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
CVE: CVE-2020-15894
Published: 2020-07-22
Description: An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by setting the value of _POST_SERVICES in the query string to DEVICE.ACCOUNT.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169; https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
CVE: CVE-2020-15895
Published: 2020-07-22
Description: An XSS issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter, before it's printed on the webpage.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169; https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/
CVE: CVE-2020-15896
Published: 2020-07-22
Description: An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NO_NEED_AUTH. If the value of NO_NEED_AUTH is 1, the user has direct access to the webpage without any authentication. By appending a query string NO_NEED_AUTH with the value of 1 to any protected URL, any unauthorized user can access the application directly, as demonstrated by bsc_lan.php?NO_NEED_AUTH=1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://research.loginsoft.com/bugs/authentication-bypass-in-d-link-firmware-dap-1522/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169; https://research.loginsoft.com/bugs/authentication-bypass-in-d-link-firmware-dap-1522/
CVE: CVE-2020-3452
Published: 2020-07-22
Description: A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-22
References: http://packetstormsecurity.com/files/158646/Cisco-ASA-FTD-Remote-File-Disclosure.html; http://packetstormsecurity.com/files/158647/Cisco-Adaptive-Security-Appliance-Software-9.11-Local-File-Inclusion.html; http://packetstormsecurity.com/files/159523/Cisco-ASA-FTD-9.6.4.42-Path-Traversal.html
CVE: CVE-2020-9663
Published: 2020-07-22
Description: Adobe Reader Mobile versions 20.0.1 and earlier have a directory traversal vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://helpx.adobe.com/security/products/reader-mobile/apsb20-50.html; https://helpx.adobe.com/security/products/reader-mobile/apsb20-50.html
CVE: CVE-2020-9664
Published: 2020-07-22
Description: Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://helpx.adobe.com/security/products/magento/apsb20-41.html; https://helpx.adobe.com/security/products/magento/apsb20-41.html
CVE: CVE-2020-9665
Published: 2020-07-22
Description: Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://helpx.adobe.com/security/products/magento/apsb20-41.html; https://helpx.adobe.com/security/products/magento/apsb20-41.html
CVE: CVE-2020-9674
Published: 2020-07-22
Description: Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb20-44.html; https://www.zerodayinitiative.com/advisories/ZDI-20-913/; https://helpx.adobe.com/security/products/bridge/apsb20-44.html
CVE: CVE-2020-9675
Published: 2020-07-22
Description: Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb20-44.html; https://www.zerodayinitiative.com/advisories/ZDI-20-911/; https://helpx.adobe.com/security/products/bridge/apsb20-44.html
CVE: CVE-2020-9676
Published: 2020-07-22
Description: Adobe Bridge versions 10.0.3 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb20-44.html; https://www.zerodayinitiative.com/advisories/ZDI-20-912/; https://helpx.adobe.com/security/products/bridge/apsb20-44.html
CVE: CVE-2020-9677
Published: 2020-07-22
Description: Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/prelude/apsb20-46.html; https://helpx.adobe.com/security/products/prelude/apsb20-46.html
CVE: CVE-2020-9678
Published: 2020-07-22
Description: Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/prelude/apsb20-46.html; https://helpx.adobe.com/security/products/prelude/apsb20-46.html
CVE: CVE-2020-9679
Published: 2020-07-22
Description: Adobe Prelude versions 9.0 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/prelude/apsb20-46.html; https://helpx.adobe.com/security/products/prelude/apsb20-46.html
CVE: CVE-2020-9680
Published: 2020-07-22
Description: Adobe Prelude versions 9.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/prelude/apsb20-46.html; https://helpx.adobe.com/security/products/prelude/apsb20-46.html
CVE: CVE-2020-9683
Published: 2020-07-22
Description: Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb20-45.html; https://helpx.adobe.com/security/products/photoshop/apsb20-45.html
CVE: CVE-2020-9684
Published: 2020-07-22
Description: Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-45.html; https://helpx.adobe.com/security/products/photoshop/apsb20-45.html
CVE: CVE-2020-9685
Published: 2020-07-22
Description: Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-45.html; https://helpx.adobe.com/security/products/photoshop/apsb20-45.html
CVE: CVE-2020-9686
Published: 2020-07-22
Description: Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb20-45.html; https://helpx.adobe.com/security/products/photoshop/apsb20-45.html
CVE: CVE-2020-9687
Published: 2020-07-22
Description: Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-45.html; https://helpx.adobe.com/security/products/photoshop/apsb20-45.html
CVE: CVE-2020-4369
Published: 2020-07-22
Description: IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-312
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179004; https://www.ibm.com/support/pages/node/6251285; https://exchange.xforce.ibmcloud.com/vulnerabilities/179004
CVE: CVE-2020-4371
Published: 2020-07-22
Description: IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179008; https://www.ibm.com/support/pages/node/6251287; https://exchange.xforce.ibmcloud.com/vulnerabilities/179008
CVE: CVE-2020-4372
Published: 2020-07-22
Description: IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179009; https://www.ibm.com/support/pages/node/6251289; https://exchange.xforce.ibmcloud.com/vulnerabilities/179009
CVE: CVE-2020-4385
Published: 2020-07-22
Description: IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 179266.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179266; https://www.ibm.com/support/pages/node/6251291; https://exchange.xforce.ibmcloud.com/vulnerabilities/179266
CVE: CVE-2020-4397
Published: 2020-07-22
Description: IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 179428.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179428; https://www.ibm.com/support/pages/node/6251321; https://exchange.xforce.ibmcloud.com/vulnerabilities/179428
CVE: CVE-2020-4399
Published: 2020-07-22
Description: IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. IBM X-Force ID: 179476.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179476; https://www.ibm.com/support/pages/node/6251323; https://exchange.xforce.ibmcloud.com/vulnerabilities/179476
CVE: CVE-2020-4400
Published: 2020-07-22
Description: IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179478; https://www.ibm.com/support/pages/node/6251279; https://exchange.xforce.ibmcloud.com/vulnerabilities/179478
CVE: CVE-2020-15901
Published: 2020-07-22
Description: In Nagios XI before 5.7.3, ajaxhelper.php allows remote authenticated attackers to execute arbitrary commands via cmdsubsys.
CVSS Score: 8.8 (HIGH)
References: https://insinuator.net/2020/07/security-advisories-for-nagios-xi/; https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/products/security/
CVE: CVE-2020-15902
Published: 2020-07-22
Description: Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://insinuator.net/2020/07/security-advisories-for-nagios-xi/; https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/products/security/
CVE: CVE-2020-10917
Published: 2020-07-22
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RMI service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10007.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.zerodayinitiative.com/advisories/ZDI-20-684/; https://www.zerodayinitiative.com/advisories/ZDI-20-684/
CVE: CVE-2020-15126
Published: 2020-07-22
Description: In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430; https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa; https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
CVE: CVE-2020-15904
Published: 2020-07-22
Description: A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a crafted patch file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/ilanschnell/bsdiff4/blob/master/CHANGELOG.txt; https://github.com/ilanschnell/bsdiff4/commit/49a4cee2feef7deaf9d89e5e793a[PII_REDACTED]d7; https://github.com/ilanschnell/bsdiff4/blob/master/CHANGELOG.txt
CVE: CVE-2020-15908
Published: 2020-07-23
Description: tar/TarFileReader.cpp in Cauldron cbang (aka C-Bang or C!) before 1.6.0 allows Directory Traversal during extraction from a TAR archive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/CauldronDevelopmentLLC/cbang/commit/1c1dba62bd3e6fa9d0d0c0aa21926043b75382c7; https://github.com/CauldronDevelopmentLLC/cbang/compare/1.5.1...1.6.0; https://github.com/CauldronDevelopmentLLC/cbang/commit/1c1dba62bd3e6fa9d0d0c0aa21926043b75382c7
CVE: CVE-2020-15688
Published: 2020-07-23
Description: The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294
References: http://packetstormsecurity.com/files/159505/EmbedThis-GoAhead-Web-Server-5.1.1-Digest-Authentication-Capture-Replay-Nonce-Reuse.html; https://github.com/embedthis/goahead-gpl/issues/3; https://github.com/embedthis/goahead-gpl/issues/3
CVE: CVE-2020-11440
Published: 2020-07-23
Description: httpRpmFs in WebCLI in Wind River VxWorks 5.5 through 7 SR0640 has no check for an escape from the web root.
CVSS Score: 7.5 (HIGH)
References: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-11440; https://windriver.com; https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-11440
CVE: CVE-2020-15881
Published: 2020-07-23
Description: A Cross-Site Scripting (XSS) vulnerability in the munki_facts (aka Munki Conditions) module before 1.5 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the key name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/munkireport/munki_facts/releases; https://github.com/munkireport/munkireport-php; https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3
CVE: CVE-2020-15882
Published: 2020-07-23
Description: A CSRF issue in manager/delete_machine/{id} in MunkiReport before 5.6.3 allows attackers to delete arbitrary machines from the MunkiReport database.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/munkireport/munkireport-php/releases; https://github.com/munkireport/munkireport-php/releases/tag/v5.6.3; https://github.com/munkireport/munkireport-php/wiki/20200722-CSRF-Bypass-On-Endpoints-With-No-Body-Parameters