deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19556
Published: 2020-11-16
Description: An authentication bypass in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with physical access to device hardware to obtain system information.
CVSS Score: 4.6 (MEDIUM)
References: https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829; https://skygo.360.cn/archive/Security-Research-Report-on-Mercedes-Benz-Cars-en.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829
CVE: CVE-2019-19557
Published: 2020-11-16
Description: A misconfiguration in the debug interface in Mercedes-Benz HERMES 1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
CVSS Score: 2.4 (LOW)
CWE: CWE-922
References: https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829; https://skygo.360.cn/archive/Security-Research-Report-on-Mercedes-Benz-Cars-en.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829
CVE: CVE-2019-19560
Published: 2020-11-16
Description: An authentication bypass in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with physical access to device hardware to obtain system information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829; https://skygo.360.cn/archive/Security-Research-Report-on-Mercedes-Benz-Cars-en.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829
CVE: CVE-2019-19561
Published: 2020-11-16
Description: A misconfiguration in the debug interface in Mercedes-Benz HERMES 1.5 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
CVSS Score: 2.4 (LOW)
CWE: CWE-922
References: https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829; https://skygo.360.cn/archive/Security-Research-Report-on-Mercedes-Benz-Cars-en.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829
CVE: CVE-2019-19562
Published: 2020-11-16
Description: An authentication bypass in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with physical access to device hardware to obtain system information.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829; https://skygo.360.cn/archive/Security-Research-Report-on-Mercedes-Benz-Cars-en.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829
CVE: CVE-2019-19563
Published: 2020-11-16
Description: A misconfiguration in the debug interface in Mercedes-Benz HERMES 2.1 allows an attacker with direct physical access to device hardware to obtain cellular modem information.
CVSS Score: 2.4 (LOW)
References: https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829; https://skygo.360.cn/archive/Security-Research-Report-on-Mercedes-Benz-Cars-en.pdf; https://media.daimler.com/marsMediaSite/en/instance/ko/Mercedes-Benz-and-360-Group-to-join-forces-Mercedes-Benz-and-360-Group-with-its-Cyber-Security-Brain-work-together-to-strengthen-car-IT-security-for-industry.xhtml?oid=45208829
CVE: CVE-2020-25694
Published: 2020-11-16
Description: A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-327, CWE-327
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894423; https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html; https://security.gentoo.org/glsa/202012-07
CVE: CVE-2020-25695
Published: 2020-11-16
Description: A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://bugzilla.redhat.com/show_bug.cgi?id=1894425; https://lists.debian.org/debian-lts-announce/2020/12/msg00005.html; https://security.gentoo.org/glsa/202012-07
CVE: CVE-2020-2490
Published: 2020-11-16
Description: If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-20-09; https://www.qnap.com/en/security-advisory/qsa-20-09
CVE: CVE-2020-2492
Published: 2020-11-16
Description: If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-20-09; https://www.qnap.com/en/security-advisory/qsa-20-09
CVE: CVE-2020-5666
Published: 2020-11-16
Description: Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://jvn.jp/en/jp/JVN44764844/index.html; https://jvn.jp/jp/JVN44764844/index.html; https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01
CVE: CVE-2020-8152
Published: 2020-11-16
Description: Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the public key to decrypt them later on.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-522, CWE-522
References: http://seclists.org/fulldisclosure/2020/Dec/54; https://hackerone.com/reports/743505; https://nextcloud.com/security/advisory/?id=NC-SA-2020-040
CVE: CVE-2020-8259
Published: 2020-11-16
Description: Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.
CVSS Score: 8.1 (HIGH)
CWE: CWE-522, CWE-522
References: https://hackerone.com/reports/732431; https://nextcloud.com/security/advisory/?id=NC-SA-2020-041; https://hackerone.com/reports/732431
CVE: CVE-2020-8269
Published: 2020-11-16
Description: An unprivileged Windows user on the VDA can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9
CVSS Score: 8.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://support.citrix.com/article/CTX285059; https://support.citrix.com/article/CTX285059
CVE: CVE-2020-8270
Published: 2020-11-16
Description: An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://support.citrix.com/article/CTX285059; https://support.citrix.com/article/CTX285059
CVE: CVE-2020-8271
Published: 2020-11-16
Description: Unauthenticated remote code execution with root privileges in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-23, CWE-22
References: https://support.citrix.com/article/CTX285061; https://support.citrix.com/article/CTX285061
CVE: CVE-2020-8272
Published: 2020-11-16
Description: Authentication Bypass resulting in exposure of SD-WAN functionality in Citrix SD-WAN Center versions before 11.2.2, 11.1.2b and 10.2.8
CVSS Score: 7.5 (HIGH)
CWE: CWE-287, CWE-287
References: https://support.citrix.com/article/CTX285061; https://support.citrix.com/article/CTX285061
CVE: CVE-2020-8273
Published: 2020-11-16
Description: Privilege escalation of an authenticated user to root in Citrix SD-WAN center versions before 11.2.2, 11.1.2b and 10.2.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://support.citrix.com/article/CTX285061; https://support.citrix.com/article/CTX285061
CVE: CVE-2020-28642
Published: 2020-11-16
Description: In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-338
References: https://www.whitehack.de/advisories/HWADV2020-001.txt; https://www.whitehack.de/advisories/HWADV2020-001.txt
CVE: CVE-2020-28648
Published: 2020-11-16
Description: Improper input validation in the Auto-Discovery component of Nagios XI before 5.7.5 allows an authenticated attacker to execute remote code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/162783/Nagios-XI-Fusion-Privilege-Escalation-Cross-Site-Scripting-Code-Execution.html; https://skylightcyber.com/2021/05/20/13-nagios-vulnerabilities-7-will-shock-you/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-28649
Published: 2020-11-16
Description: The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://wordpress.org/plugins/orbisius-child-theme-creator/#developers; https://www.wordfence.com/blog/2020/10/high-severity-vulnerability-patched-in-child-theme-creator-by-orbisius/; https://wordpress.org/plugins/orbisius-child-theme-creator/#developers
CVE: CVE-2020-28650
Published: 2020-11-16
Description: The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/blog/2020/10/vulnerability-exposes-over-4-million-sites-using-wpbakery/; https://www.wordfence.com/blog/2020/10/vulnerability-exposes-over-4-million-sites-using-wpbakery/
CVE: CVE-2020-28656
Published: 2020-11-16
Description: The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary code because some unsigned parts of a metainfo file are parsed, which can cause attacker-controlled files to be written to the infotainment system and executed as root.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-354
References: https://www.contextis.com/en/blog/a-code-signing-bypass-for-the-vw-polo; https://www.contextis.com/en/blog/a-code-signing-bypass-for-the-vw-polo
CVE: CVE-2020-5659
Published: 2020-11-16
Description: SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://jvn.jp/en/vu/JVNVU92053563/index.html; https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=13; https://jvn.jp/en/vu/JVNVU92053563/index.html
CVE: CVE-2020-5662
Published: 2020-11-16
Description: Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/vu/JVNVU92053563/index.html; https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=13; https://jvn.jp/en/vu/JVNVU92053563/index.html
CVE: CVE-2020-5663
Published: 2020-11-16
Description: Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/vu/JVNVU92053563/index.html; https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=13; https://jvn.jp/en/vu/JVNVU92053563/index.html
CVE: CVE-2020-5664
Published: 2020-11-16
Description: Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://jvn.jp/en/vu/JVNVU92053563/index.html; https://xoonips.osdn.jp/modules/news/index.php?page=article&storyid=13; https://jvn.jp/en/vu/JVNVU92053563/index.html
CVE: CVE-2020-7765
Published: 2020-11-16
Description: This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
CVSS Score: 5.6 (MEDIUM)
References: https://github.com/firebase/firebase-js-sdk/commit/9cf727fcc3d049551b16ae0698ac33dc2fe45ada; https://github.com/firebase/firebase-js-sdk/pull/4001; https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324
CVE: CVE-2020-7773
Published: 2020-11-16
Description: This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require("markdown-it-highlightjs"); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs, { inline: true }) .render('console.log(42){.">js}'); console.log(reuslt_xss);
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://github.com/valeriangalliat/markdown-it-highlightjs/blob/v3.3.0/index.js%23L52; https://github.com/valeriangalliat/markdown-it-highlightjs/pull/14; https://snyk.io/vuln/SNYK-JS-MARKDOWNITHIGHLIGHTJS-1040461
CVE: CVE-2020-8897
Published: 2020-11-16
Description: A weak robustness vulnerability exists in the AWS Encryption SDKs for Java, Python, C and Javalcript prior to versions 2.0.0. Due to the non-committing property of AES-GCM (and other AEAD ciphers such as AES-GCM-SIV or (X)ChaCha20Poly1305) used by the SDKs to encrypt messages, an attacker can craft a unique cyphertext which will decrypt to multiple different results, and becomes especially relevant in a multi-recipient setting. We recommend users update their SDK to 2.0.0 or later.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-310, CWE-327
References: https://aws.amazon.com/blogs/security/improved-client-side-encryption-explicit-keyids-and-key-commitment/; https://github.com/google/security-research/security/advisories/GHSA-wqgp-vphw-hphf; https://aws.amazon.com/blogs/security/improved-client-side-encryption-explicit-keyids-and-key-commitment/
CVE: CVE-2020-24366
Published: 2020-11-16
Description: Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups.
CVSS Score: 3.3 (LOW)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-25013
Published: 2020-11-16
Description: JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler.
CVSS Score: 7.5 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-25207
Published: 2020-11-16
Description: JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-25209
Published: 2020-11-16
Description: In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API.
CVSS Score: 7.5 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-25210
Published: 2020-11-16
Description: In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27459
Published: 2020-11-16
Description: Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/nugmubs/chronoforums-cve/wiki/Stored-XSS-Vulnerability-in-Chronoforum-v2.0.11-%28Joomla-plugin%29; https://github.com/nugmubs/chronoforums-cve/wiki/Stored-XSS-Vulnerability-in-Chronoforum-v2.0.11-%28Joomla-plugin%29
CVE: CVE-2020-27624
Published: 2020-11-16
Description: JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27625
Published: 2020-11-16
Description: In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com
CVE: CVE-2020-27626
Published: 2020-11-16
Description: JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27628
Published: 2020-11-16
Description: In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.
CVSS Score: 4.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27629
Published: 2020-11-16
Description: In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-13769
Published: 2020-11-16
Description: LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://forums.ivanti.com/s/; https://labs.jumpsec.com/advisory-cve-2020-13769-ivanti-uem-sql-injection/; https://forums.ivanti.com/s/
CVE: CVE-2020-13772
Published: 2020-11-16
Description: In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required.
CVSS Score: 5.3 (MEDIUM)
References: https://forums.ivanti.com/s/; https://labs.jumpsec.com/cve-2020-13772-ivanti-uem-system-information-disclosure/; https://forums.ivanti.com/s/
CVE: CVE-2020-13773
Published: 2020-11-16
Description: Ivanti Endpoint Manager through 2020.1.1 allows XSS via /LDMS/frm_splitfrm.aspx, /LDMS/licensecheck.aspx, /LDMS/frm_splitcollapse.aspx, /LDMS/alert_log.aspx, /LDMS/ServerList.aspx, /LDMS/frm_coremainfrm.aspx, /LDMS/frm_findfrm.aspx, /LDMS/frm_taskfrm.aspx, and /LDMS/query_browsecomp.aspx.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://forums.ivanti.com/s/; https://labs.jumpsec.com/cve-2020-13773-ivanti-uem-reflected-xss/; https://forums.ivanti.com/s/
CVE: CVE-2020-25952
Published: 2020-11-16
Description: SQL injection vulnerability in PHPGurukul User Registration & Login and User Management System With admin panel 2.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://phpgurukul.com/; https://systemweakness.com/cve-2020-25952-f60fff8ffac; https://th3cyb3rc0p.medium.com/cve-2020-25952-f60fff8ffac
CVE: CVE-2020-26129
Published: 2020-11-16
Description: In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-444
References: https://blog.jetbrains.com; https://blog.jetbrains.com/2020/11/16/jetbrains-security-bulletin-q3-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27191
Published: 2020-11-16
Description: LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 7.5 (HIGH)
References: http://lionwiki.0o.cz/index.php?page=Main+page; https://www.junebug.site/blog/cve-2020-27191-lionwiki-3-2-11-lfi; http://lionwiki.0o.cz/index.php?page=Main+page
CVE: CVE-2020-27422
Published: 2020-11-16
Description: In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html; https://www.anuko.com/time-tracker/index.htm; https://packetstormsecurity.com/files/160051/Anuko-Time-Tracker-1.19.23.5311-Password-Reset.html
CVE: CVE-2020-27423
Published: 2020-11-16
Description: Anuko Time Tracker v1.19.23.5311 lacks rate limit on the password reset module which allows attacker to perform Denial of Service attack on any legitimate user's mailbox
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://packetstormsecurity.com/files/160052/Anuko-Time-Tracker-1.19.23.5311-Missing-Rate-Limiting.html; https://packetstormsecurity.com/files/160052/Anuko-Time-Tracker-1.19.23.5311-Missing-Rate-Limiting.html