deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19937
Published: 2020-03-16
Description: In JFrog Artifactory before 6.18, it is not possible to restrict either system or repository imports by any admin user in the enterprise, which can lead to "undesirable results."
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://www.jfrog.com/confluence/display/RTF6X/Importing+and+Exporting; https://www.jfrog.com/confluence/display/RTF6X/Release+Notes#ReleaseNotes-Artifactory6.18; https://www.secureworks.com/research/subject/advisories
CVE: CVE-2020-7608
Published: 2020-03-16
Description: yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-1321
References: https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381; https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
CVE: CVE-2020-9471
Published: 2020-03-16
Description: Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://gitlab.com/eLeN3Re/cve-2020-9471; https://gitlab.com/eLeN3Re/cve-2020-9471
CVE: CVE-2020-9472
Published: 2020-03-16
Description: Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://gitlab.com/eLeN3Re/cve-2020-9472; https://gitlab.com/eLeN3Re/cve-2020-9472
CVE: CVE-2019-19538
Published: 2020-03-16
Description: In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation.
CVSS Score: 7.2 (HIGH)
References: https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-00; https://wiki.freepbx.org/display/FOP/2019-12-03+Remote+Command+Execution; https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-00
CVE: CVE-2019-19610
Published: 2020-03-16
Description: An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-384
References: https://excellium-services.com/cert-xlm-advisory/; https://excellium-services.com/cert-xlm-advisory/cve-2019-19610/; https://halvotec.de/produkte/raquest/
CVE: CVE-2019-19612
Published: 2020-03-16
Description: An issue was discovered in Halvotec RaQuest 10.23.10801.0. Several features of the application allow stored Cross-site Scripting (XSS). Fixed in Release 24.2020.20608.0.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://excellium-services.com/cert-xlm-advisory/; https://excellium-services.com/cert-xlm-advisory/cve-2019-19612/; https://halvotec.de/produkte/raquest/
CVE: CVE-2019-19613
Published: 2020-03-16
Description: An issue was discovered in Halvotec RaQuest 10.23.10801.0. The login page of the admin application is vulnerable to an Open Redirect attack allowing an attacker to redirect a user to a malicious site after authentication. The attacker needs to be on the same network to modify the victim's request on the wire. Fixed in Release 24.2020.20608.0
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-601
References: https://excellium-services.com/cert-xlm-advisory/; https://excellium-services.com/cert-xlm-advisory/cve-2019-19613/; https://halvotec.de/produkte/raquest/
CVE: CVE-2019-19615
Published: 2020-03-16
Description: Multiple XSS vulnerabilities exist in the Backup & Restore module \ v14.0.10.2 through v14.0.10.7 for FreePBX, as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link, the XSS payload will render and execute in the context of the victim user's account.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities; https://wiki.freepbx.org/pages/viewpage.action?pageId=175177911; https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities
CVE: CVE-2019-19852
Published: 2020-03-16
Description: An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wiki.freepbx.org/display/FOP/2020-01-09+XSS+Injection+vulnerability+in+Call+Event+Logging+module; https://wiki.freepbx.org/display/FOP/List+of+Securities+Vulnerabilities; https://wiki.freepbx.org/display/FOP/2020-01-09+XSS+Injection+vulnerability+in+Call+Event+Logging+module
CVE: CVE-2019-20491
Published: 2020-03-16
Description: cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).
CVSS Score: 5.4 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2020-6175
Published: 2020-03-16
Description: Citrix SD-WAN 10.2.x before 10.2.6 and 11.0.x before 11.0.3 has Missing SSL Certificate Validation.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://support.citrix.com/article/CTX263526; https://support.citrix.com/search; https://support.citrix.com/article/CTX263526
CVE: CVE-2020-7248
Published: 2020-03-16
Description: libubox in OpenWrt before 18.06.7 and 19.x before 19.07.1 has a tagged binary data JSON serialization vulnerability that may cause a stack based buffer overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/openwrt/openwrt/commits/master; https://nvd.nist.gov/vuln/detail/CVE-2020-7248#range-4512438; https://openwrt.org/advisory/2020-01-31-2
CVE: CVE-2020-7919
Published: 2020-03-16
Description: Go before 1.12.16 and 1.13.x before 1.13.7 (and the crypto/cryptobyte package before 0.0.0[PII_REDACTED]5646-8b5121be2f68 for Go) allows attacks on clients (resulting in a panic) via a malformed X.509 certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://groups.google.com/forum/#%21forum/golang-announce; https://groups.google.com/forum/#%21topic/golang-announce/-sdUB4VEQkA; https://groups.google.com/forum/#%21topic/golang-announce/Hsw4mHYc470
CVE: CVE-2019-20191
Published: 2020-03-16
Description: Oxygen XML Editor 21.1.1 allows XXE to read any file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://medium.com/%40Pablo0xSantiago/cve-2019-20191-oxygen-xml-editor-21-1-1-allows-xxe-216b816f312b; https://medium.com/%40Pablo0xSantiago/cve-2019-20191-oxygen-xml-editor-21-1-1-allows-xxe-216b816f312b
CVE: CVE-2019-20326
Published: 2020-03-16
Description: A heap-based buffer overflow in _cairo_image_surface_create_from_jpeg() in extensions/cairo_io/cairo-image-surface-jpeg.c in GNOME gThumb before 3.8.3 and Linux Mint Pix before 2.4.5 allows attackers to cause a crash and potentially execute arbitrary code via a crafted JPEG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/Fysac/CVE-2019-20326; https://gitlab.gnome.org/GNOME/gthumb/commit/4faa5ce2358812d23a1147953ee76f59631590ad; https://gitlab.gnome.org/GNOME/gthumb/commit/ca8f528209ab78935c30e42fe53bdf1a24f3cb44
CVE: CVE-2020-7982
Published: 2020-03-16
Description: An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).
CVSS Score: 8.1 (HIGH)
CWE: CWE-345, CWE-754
References: https://arstechnica.com/information-technology/2020/03/openwrt-is-vulnerable-to-attacks-that-execute-malicious-code/; https://blog.forallsecure.com/uncovering-openwrt-remote-code-execution-cve-2020-7982; https://github.com/openwrt/openwrt/commits/master
CVE: CVE-2020-8783
Published: 2020-03-16
Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE: CVE-2020-8784
Published: 2020-03-16
Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE: CVE-2020-8785
Published: 2020-03-16
Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE: CVE-2020-8786
Published: 2020-03-16
Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE: CVE-2020-8787
Published: 2020-03-16
Description: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_11; https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_23
CVE: CVE-2020-9346
Published: 2020-03-16
Description: Zoho ManageEngine Password Manager Pro 10.4 and prior has no protection against Cross-site Request Forgery (CSRF) attacks, as demonstrated by changing a user's role.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.4_CSRF.txt; https://www.manageengine.com/products/passwordmanagerpro/issues-fixed.html; https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.4_CSRF.txt
CVE: CVE-2020-9347
Published: 2020-03-16
Description: Zoho ManageEngine Password Manager Pro through 10.x has a CSV Excel Macro Injection vulnerability via a crafted name that is mishandled by the Export Passwords feature. NOTE: the vendor disputes the significance of this report because they expect CSV risk mitigation to be provided by an external application, and do not plan to add CSV constraints to their own products
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1236
References: https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.x_CSV_Excel_Macro_Injection.txt; https://www.infigo.hr/upload/web_struktura/Zoho_ManageEngine_Password_Manager_Pro_10.x_CSV_Excel_Macro_Injection.txt
CVE: CVE-2019-20105
Published: 2020-03-17
Description: The EditApplinkServlet resource in the Atlassian Application Links plugin before version 5.4.20, from version 6.0.0 before version 6.0.12, from version 6.1.0 before version 6.1.2, from version 7.0.0 before version 7.0.1, and from version 7.1.0 before version 7.1.3 allows remote attackers who have obtained access to administrator's session to access the EditApplinkServlet resource without needing to re-authenticate to pass "WebSudo" in products that support "WebSudo" through an improper access control vulnerability.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-306
References: https://ecosystem.atlassian.net/browse/APL-1391; https://jira.atlassian.com/browse/JRASERVER-70526; https://ecosystem.atlassian.net/browse/APL-1391
CVE: CVE-2019-20407
Published: 2020-03-17
Description: The ConfigureBambooRelease resource in Jira Software and Jira Software Data Center before version 8.6.1 allows authenticated remote attackers to view release version information in projects that they do not have access to through an missing authorisation check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://jira.atlassian.com/browse/JRASERVER-70599; https://jira.atlassian.com/browse/JRASERVER-70599
CVE: CVE-2020-6646
Published: 2020-03-17
Description: An improper neutralization of input vulnerability in FortiWeb allows a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the Disclaimer Description of a Replacement Message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/advisory/FG-IR-20-001; https://fortiguard.com/advisory/FG-IR-20-001
CVE: CVE-2019-20452
Published: 2020-03-17
Description: A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/core.access/src/RecycleBinManager.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release; https://www.certilience.fr/2020/03/cve-2019-20452-vulnerabilite-php-object-injection-pydio-core/; https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release
CVE: CVE-2019-20453
Published: 2020-03-17
Description: A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release; https://www.certilience.fr/2020/03/cve-2019-20453-vulnerabilite-php-object-injection-pydio-core/; https://pydio.com/en/community/releases/pydio-core/pydio-core-pydio-enterprise-824-security-release
CVE: CVE-2020-10380
Published: 2020-03-17
Description: RMySQL through 0.10.19 allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/r-dbi/RMySQL/blob/master/NEWS.md; https://github.com/r-dbi/RMySQL/blob/master/NEWS.md
CVE: CVE-2018-18576
Published: 2020-03-17
Description: The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/admin/dashboard/ URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://pastebin.com/ndDJT3d3; https://wordpress.org/plugins/wordpress-popup/#developers; https://pastebin.com/ndDJT3d3
CVE: CVE-2018-21037
Published: 2020-03-17
Description: Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the panel/members/edit/1 URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/intelliants/subrion/issues/638; https://github.com/intelliants/subrion/issues/638
CVE: CVE-2019-11074
Published: 2020-03-17
Description: A Write to Arbitrary Location in Disk vulnerability exists in PRTG Network Monitor 19.1.49 and below that allows attackers to place files in arbitrary locations with SYSTEM privileges (although not controlling the contents of such files) due to insufficient sanitisation when passing arguments to the phantomjs.exe binary. In order to exploit the vulnerability, remote authenticated administrators need to create a new HTTP Full Web Page Sensor and set specific settings when executing the sensor.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://how2itsec.blogspot.com/2019/10/security-fixes-in-prtg-1935152.html; https://sensepost.com/blog/2019/being-stubborn-pays-off-pt.-1-cve-2018-19204/; https://www.paessler.com/prtg/history/stable
CVE: CVE-2019-20490
Published: 2020-03-17
Description: cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).
CVSS Score: 8.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-20492
Published: 2020-03-17
Description: cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).
CVSS Score: 8.8 (HIGH)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-20493
Published: 2020-03-17
Description: cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-20494
Published: 2020-03-17
Description: In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).
CVSS Score: 3.3 (LOW)
CWE: CWE-330
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-20495
Published: 2020-03-17
Description: cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).
CVSS Score: 6.5 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-20496
Published: 2020-03-17
Description: cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).
CVSS Score: 5.5 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-20497
Published: 2020-03-17
Description: cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2019-20498
Published: 2020-03-17
Description: cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).
CVSS Score: 9.8 (CRITICAL)
References: https://documentation.cpanel.net/display/CL/82+Change+Log; https://documentation.cpanel.net/display/CL/82+Change+Log
CVE: CVE-2020-10113
Published: 2020-03-17
Description: cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10114
Published: 2020-03-17
Description: cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10115
Published: 2020-03-17
Description: cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).
CVSS Score: 7.2 (HIGH)
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10116
Published: 2020-03-17
Description: cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10117
Published: 2020-03-17
Description: cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
CVSS Score: 9.1 (CRITICAL)
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10118
Published: 2020-03-17
Description: cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
CVSS Score: 9.1 (CRITICAL)
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10119
Published: 2020-03-17
Description: cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
CVSS Score: 9.8 (CRITICAL)
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10120
Published: 2020-03-17
Description: cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
CVSS Score: 7.2 (HIGH)
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10121
Published: 2020-03-17
Description: cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
CVSS Score: 9.8 (CRITICAL)
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10122
Published: 2020-03-17
Description: cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
CVSS Score: 6.5 (MEDIUM)
References: https://documentation.cpanel.net/display/CL/84+Change+Log; https://documentation.cpanel.net/display/CL/84+Change+Log
CVE: CVE-2020-10596
Published: 2020-03-17
Description: OpenCart 3.0.3.2 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/157908/OpenCart-3.0.3.2-Cross-Site-Scripting.html; https://github.com/opencart/opencart/issues/7810; http://packetstormsecurity.com/files/157908/OpenCart-3.0.3.2-Cross-Site-Scripting.html
CVE: CVE-2020-1720
Published: 2020-03-17
Description: A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use this flaw in certain configurations to perform drop objects such as function, triggers, et al., leading to database corruption. This issue affects PostgreSQL versions before 12.2, before 11.7, before 10.12 and before 9.6.17.
CVSS Score: 3.1 (LOW)
CWE: CWE-285, CWE-862
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00043.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1720; https://www.postgresql.org/about/news/2011/
CVE: CVE-2020-3950
Published: 2020-03-17
Description: VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: http://packetstormsecurity.com/files/156843/VMware-Fusion-11.5.2-Privilege-Escalation.html; http://packetstormsecurity.com/files/157079/VMware-Fusion-USB-Arbitrator-Setuid-Privilege-Escalation.html; https://www.vmware.com/security/advisories/VMSA-2020-0005.html
CVE: CVE-2020-3951
Published: 2020-03-17
Description: VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of-service vulnerability due to a heap-overflow issue in Cortado Thinprint. Attackers with non-administrative access to a guest VM with virtual printing enabled may exploit this issue to create a denial-of-service condition of the Thinprint service running on the system where Workstation or Horizon Client is installed.
CVSS Score: 3.8 (LOW)
CWE: CWE-787
References: https://www.vmware.com/security/advisories/VMSA-2020-0005.html; https://www.vmware.com/security/advisories/VMSA-2020-0005.html