deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10291
Published: 2020-11-06
Description: Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol leaks information regarding the receiving serverinformation, license information and managing licenses, among others.Through this flaw, attackers can retreive information about a KUKA simulation system, particularly, the version ofthe licensing server, which is connected to the simulator, and which will allow them to launch local simulationswith similar characteristics, further understanding the dynamics of motion virtualization and opening doors toother attacks (see RVDP#711 and RVDP#712 for subsequent vulnerabilities that compromise integrity andavailability).Beyond compromising simulations, Visual Components provides capabilities to interface with industrial machinery.Particularly, their PLC Connectivity feature 'makes it easy' to connect simulations with control systems usingeither the industry standard OPC UA or other supported vendor specific interfaces. This fills the gap of jumpingfrom simulation to real and enables attackers to pivot from the Visual Components simulator to robots or otherIndustrial Control System (ICS) devices, such as PLCs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-306
References: https://github.com/aliasrobotics/RVD/issues/3336; https://github.com/aliasrobotics/RVD/issues/3336
CVE: CVE-2020-10292
Published: 2020-11-06
Description: Visual Components (owned by KUKA) is a robotic simulator that allows simulating factories and robots in order toimprove planning and decision-making processes. Visual Components software requires a special license which can beobtained from a network license server. The network license server binds to all interfaces (0.0.0.0) and listensfor packets over UDP port 5093. No authentication/authorization is required in order to communicate with theserver. The protocol being used is a property protocol by RMS Sentinel which provides the licensing infrastructurefor the network license server. RMS Sentinel license manager service exposes UDP port 5093 which provides sensitivesystem information that could be leveraged for further exploitation without any kind of authentication. Thisinformation includes detailed hardware and OS characteristics.After a decryption process, a textual protocol is found which contains a simple header with the requested command,application-identifier, and some arguments. The protocol is vulnerable to DoS through an arbitrary pointerderreference. This flaw allows an attacker to to pass a specially crafted package that, when processed by theservice, causes an arbitrary pointer from the stack to be dereferenced, causing an uncaught exception thatterminates the service. This can be further contructed in combination with RVDP#710 which exploits an informationdisclosure leak, or with RVDP#711 for an stack-overflow and potential code execution.Beyond denying simulations, Visual Components provides capabilities to interface with industrial machinery andautomate certain processes (e.g. testing, benchmarking, etc.) which depending on the DevOps setup might beintegrated into the industrial flow. Accordingly, a DoS in the simulation might have higher repercusions, dependingon the Industrial Control System (ICS) ICS infrastructure.
CVSS Score: 8.2 (HIGH)
CWE: CWE-248, CWE-119
References: https://www.visualcomponents.com/products/visual-components/; https://www.visualcomponents.com/products/visual-components/
CVE: CVE-2020-26882
Published: 2020-11-06
Description: In Play Framework 2.6.0 through 2.8.2, data amplification can occur when an application accepts multipart/form-data JSON input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://www.playframework.com/security/vulnerability; https://www.playframework.com/security/vulnerability/CVE-2020-26882-JsonParseDataAmplification; https://www.playframework.com/security/vulnerability
CVE: CVE-2020-26883
Published: 2020-11-06
Description: In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://www.playframework.com/security/vulnerability; https://www.playframework.com/security/vulnerability/CVE-2020-26883-JsonParseUncontrolledRecursion; https://www.playframework.com/security/vulnerability
CVE: CVE-2020-27196
Published: 2020-11-06
Description: An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a StackOverflowError and Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.playframework.com/security/vulnerability; https://www.playframework.com/security/vulnerability/CVE-2020-27196-DosViaJsonStackOverflow; https://www.playframework.com/security/vulnerability
CVE: CVE-2020-27589
Published: 2020-11-06
Description: Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://community.synopsys.com/s/question/0D52H00005JCZAXSA5/announcement-black-duck-defect-identified; https://github.com/blackducksoftware/hub-rest-api-python; https://github.com/blackducksoftware/hub-rest-api-python/pull/113/commits/273b27d0de1004389dd8cf43c40b1197c787e7cd
CVE: CVE-2020-4482
Published: 2020-11-06
Description: IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow an authenticated user to bypass security. A user with access to a snapshot could apply unauthorized additional statuses via direct rest calls. IBM X-Force ID: 181856.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181856; https://www.ibm.com/support/pages/node/6337603; https://exchange.xforce.ibmcloud.com/vulnerabilities/181856
CVE: CVE-2020-4483
Published: 2020-11-06
Description: IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 181857.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181857; https://www.ibm.com/support/pages/node/6360835; https://exchange.xforce.ibmcloud.com/vulnerabilities/181857
CVE: CVE-2020-4484
Published: 2020-11-06
Description: IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 could disclose sensitive information to an authenticated user that could be used in further attacks against the system. IBM X-Force ID: 181858.
CVSS Score: 4.3 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181858; https://www.ibm.com/support/pages/node/6337605; https://exchange.xforce.ibmcloud.com/vulnerabilities/181858
CVE: CVE-2020-5795
Published: 2020-11-06
Description: UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)_V5_200721 allows an authenticated admin user, with physical access and network access, to execute arbitrary code after plugging a crafted USB drive into the router.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-59
References: https://www.tenable.com/security/research/tra-2020-60; https://www.tenable.com/security/research/tra-2020-60
CVE: CVE-2020-7198
Published: 2020-11-06
Description: There is a remote escalation of privilege possible for a malicious user that has a OneView account in OneView and Synergy Composer. HPE has provided updates to Oneview and Synergy Composer: Update to version 5.5 of OneView, Composer, or Composer2.
CVSS Score: 8.8 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04047en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04047en_us
CVE: CVE-2020-8580
Published: 2020-11-06
Description: SANtricity OS Controller Software versions 11.30 and higher are susceptible to a vulnerability which allows an unauthenticated attacker with access to the system to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-25170
Published: 2020-11-06
Description: An Excel Macro Injection vulnerability exists in the export feature in the B. Braun OnlineSuite Version AP 3.0 and earlier via multiple input fields that are mishandled in an Excel export.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01; https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01
CVE: CVE-2020-25172
Published: 2020-11-06
Description: A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01; https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01
CVE: CVE-2020-25174
Published: 2020-11-06
Description: A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01; https://us-cert.cisa.gov/ics/advisories/icsma-20-296-01
CVE: CVE-2020-26213
Published: 2020-11-06
Description: In teler before version 0.0.1, if you run teler inside a Docker container and encounter `errors.Exit` function, it will cause denial-of-service (`SIGSEGV`) because it doesn't get process ID and process group ID of teler properly to kills. The issue is patched in teler 0.0.1 and 0.0.1-dev5.1.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://github.com/kitabisa/teler/commit/ec6082049dba9e44a21f35fb7b123d42ce1a1a7e; https://github.com/kitabisa/teler/security/advisories/GHSA-jhj6-5mh6-4pvf; https://github.com/kitabisa/teler/commit/ec6082049dba9e44a21f35fb7b123d42ce1a1a7e
CVE: CVE-2020-5794
Published: 2020-11-06
Description: A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://www.tenable.com/security/tns-2020-09; https://www.tenable.com/security/tns-2020-09
CVE: CVE-2020-8577
Published: 2020-11-06
Description: SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session.
CVSS Score: 5.9 (MEDIUM)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-18926
Published: 2020-11-06
Description: raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: http://www.openwall.com/lists/oss-security/2020/11/13/1; http://www.openwall.com/lists/oss-security/2020/11/13/2; http://www.openwall.com/lists/oss-security/2020/11/14/2
CVE: CVE-2020-26214
Published: 2020-11-06
Description: In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65; https://github.com/alerta/alerta/issues/1277; https://github.com/alerta/alerta/pull/1345
CVE: CVE-2020-26083
Published: 2020-11-06
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need to have valid administrative credentials.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxs-pkjCmq9d; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xxs-pkjCmq9d
CVE: CVE-2020-26084
Published: 2020-11-06
Description: A vulnerability in the REST API of Cisco Edge Fog Fabric could allow an authenticated, remote attacker to access files outside of their authorization sphere on an affected device. The vulnerability is due to incorrect authorization enforcement on an affected system. An attacker could exploit this vulnerability by sending a crafted request to the API. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-eff-incperm-9E6h4yBz; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-eff-incperm-9E6h4yBz
CVE: CVE-2020-26086
Published: 2020-11-06
Description: A vulnerability in the video endpoint API (xAPI) of Cisco TelePresence Collaboration Endpoint (CE) Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected device. The vulnerability is due to improper storage of sensitive information on an affected device. An attacker could exploit this vulnerability by accessing information that should not be accessible to users with low privileges. A successful exploit could allow the attacker to gain access to sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-668, CWE-668
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tele-info-DrEGLpDQ; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tele-info-DrEGLpDQ
CVE: CVE-2020-27121
Published: 2020-11-06
Description: A vulnerability in Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) Software could allow an authenticated, remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of login requests. An attacker could exploit this vulnerability by sending a crafted client login request to an affected device. A successful exploit could allow the attacker to cause a process to crash, resulting in a DoS condition for new login attempts. Users who are authenticated at the time of the attack would not be affected. There are workarounds that address this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-248, CWE-755
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-dos-uTx2dqu2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-dos-uTx2dqu2
CVE: CVE-2020-27122
Published: 2020-11-06
Description: A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a valid administrator account on an affected device. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to the system with a crafted Active Directory account. A successful exploit could allow the attacker to obtain root privileges on an affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-266, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-fNZX8hHj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-fNZX8hHj
CVE: CVE-2020-27123
Published: 2020-11-06
Description: A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system of the affected device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-749
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-file-read-LsvDD6Uh; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-file-read-LsvDD6Uh
CVE: CVE-2020-27128
Published: 2020-11-06
Description: A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-file-Y2JSRNRb; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-file-Y2JSRNRb
CVE: CVE-2020-27129
Published: 2020-11-06
Description: A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the affected application. An attacker could exploit this vulnerability by sending malicious requests to the affected application. A successful exploit could allow the attacker to inject arbitrary commands and potentially gain elevated privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-88, CWE-88
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-privilege-zPmMf73k; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-privilege-zPmMf73k
CVE: CVE-2020-28327
Published: 2020-11-06
Description: A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-404
References: http://downloads.asterisk.org/pub/security/AST-2020-001.html; https://issues.asterisk.org/jira/browse/ASTERISK-29057; http://downloads.asterisk.org/pub/security/AST-2020-001.html
CVE: CVE-2020-28328
Published: 2020-11-06
Description: SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled .php file under the web root.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/159937/SuiteCRM-7.11.15-Remote-Code-Execution.html; http://packetstormsecurity.com/files/162975/SuiteCRM-Log-File-Remote-Code-Execution.html; http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html
CVE: CVE-2020-3284
Published: 2020-11-06
Description: A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remote attacker to execute unsigned code during the PXE boot process on an affected device. The PXE boot loader is part of the BIOS and runs over the management interface of hardware platforms that are running Cisco IOS XR Software only. The vulnerability exists because internal commands that are issued when the PXE network boot process is loading a software image are not properly verified. An attacker could exploit this vulnerability by compromising the PXE boot server and replacing a valid software image with a malicious one. Alternatively, the attacker could impersonate the PXE boot server and send a PXE boot reply with a malicious file. A successful exploit could allow the attacker to execute unsigned code on the affected device. Note: To fix this vulnerability, both the Cisco IOS XR Software and the BIOS must be upgraded. The BIOS code is included in Cisco IOS XR Software but might require additional installation steps. For further information, see the Fixed Software section of this advisory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pxe-unsign-code-exec-qAa78fD2; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pxe-unsign-code-exec-qAa78fD2