deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-28914
Published: 2020-11-17
Description: An improper file permissions vulnerability affects Kata Containers prior to 1.11.5. When using a Kubernetes hostPath volume and mounting either a file or directory into a container as readonly, the file/directory is mounted as readOnly inside the container, but is still writable inside the guest. For a container breakout situation, a malicious guest can potentially modify or delete files/directories expected to be read-only.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://github.com/kata-containers/kata-containers/pull/1062; https://github.com/kata-containers/runtime/pull/3042; https://github.com/kata-containers/runtime/pull/3051
CVE: CVE-2020-28183
Published: 2020-11-17
Description: SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/sartlabs/0days/tree/main/WBS; https://research-labs.net/search/exploits/water-billing-system-10-username-and-password-parameters-sql-injection; https://www.exploit-db.com/exploits/49032
CVE: CVE-2020-28915
Published: 2020-11-18
Description: A buffer over-read (at the framebuffer layer) in the fbcon code in the Linux kernel before 5.8.15 could be used by local attackers to read kernel memory, aka CID-6735b4632def.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.suse.com/show_bug.cgi?id=1178886; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.15; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5af08640795b2b9a940c9266c[PII_REDACTED]ae262
CVE: CVE-2020-28917
Published: 2020-11-18
Description: An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-312
References: https://typo3.org/security/advisory/typo3-ext-sa-2020-019; https://typo3.org/security/advisory/typo3-ext-sa-2020-019
CVE: CVE-2020-24723
Published: 2020-11-18
Description: Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With admin panel 2.1.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://phpgurukul.com/; https://systemweakness.com/cve-2020-24723-89ea76588286; https://th3cyb3rc0p.medium.com/cve-2020-24723-89ea76588286
CVE: CVE-2020-28361
Published: 2020-11-18
Description: Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. This occurs in the remove_hf function in the Kamailio textops module. Particular use of remove_hf in Sippy Softswitch may allow skilled attacker having a valid credential in the system to disrupt internal call start/duration accounting mechanisms leading potentially to a loss of revenue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-444
References: https://packetstormsecurity.com/files/159030/Kamailio-5.4.0-Header-Smuggling.html; https://support.sippysoft.com/support/discussions/topics/[PII_REDACTED]; https://packetstormsecurity.com/files/159030/Kamailio-5.4.0-Header-Smuggling.html
CVE: CVE-2020-7562
Published: 2020-11-18
Description: A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-01/; https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
CVE: CVE-2020-7563
Published: 2020-11-18
Description: A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-01/; https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
CVE: CVE-2020-7564
Published: 2020-11-18
Description: A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.se.com/ww/en/download/document/SEVD-2020-315-01/; https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
CVE: CVE-2020-28724
Published: 2020-11-18
Description: Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/pallets/flask/issues/1639; https://github.com/pallets/werkzeug/issues/822; https://github.com/pallets/werkzeug/pull/890/files
CVE: CVE-2020-6016
Published: 2020-11-18
Description: Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflow and a free() of memory not from the heap, resulting in a memory corruption and probably even a remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-590, CWE-787
References: https://github.com/ValveSoftware/GameNetworkingSockets/commit/e0c86dcb9139771db3db0cfdb1fb8bef0af19c43; https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets/; https://github.com/ValveSoftware/GameNetworkingSockets/commit/e0c86dcb9139771db3db0cfdb1fb8bef0af19c43
CVE: CVE-2020-24297
Published: 2020-11-18
Description: httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixed version: TL-WPA4220(EU)_V4_201023
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://the-hyperbolic.com/posts/vulnerabilities-in-tlwpa4220/; https://www.tp-link.com/us/support/download/; https://the-hyperbolic.com/posts/vulnerabilities-in-tlwpa4220/
CVE: CVE-2020-25406
Published: 2020-11-18
Description: app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files.
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://www.misakikata.com/codes/File%20Upload.html; https://www.misakikata.com/codes/File%20Upload.html
CVE: CVE-2020-26884
Published: 2020-11-18
Description: RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://community.rsa.com/docs/DOC-114997; https://community.rsa.com/docs/DOC-114997
CVE: CVE-2020-28005
Published: 2020-11-18
Description: httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow (causing a denial of service) by sending a POST request to the /admin/syslog endpoint. Fixed version: TL-WPA4220(EU)_V4_201023
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://the-hyperbolic.com/posts/vulnerabilities-in-tlwpa4220/; https://www.tp-link.com/us/security; https://the-hyperbolic.com/posts/vulnerabilities-in-tlwpa4220/
CVE: CVE-2020-26554
Published: 2020-11-18
Description: REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/160077/MailDepot-2033-2.3.3022-Cross-Site-Scripting.html; https://www.syss.de/pentest-blog/syss-2020-037-persistent-cross-site-scripting-schwachstelle-in-reddoxx-maildepot; http://packetstormsecurity.com/files/160077/MailDepot-2033-2.3.3022-Cross-Site-Scripting.html
CVE: CVE-2020-26933
Published: 2020-11-18
Description: Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack.
CVSS Score: 7.2 (HIGH)
CWE: CWE-665
References: https://trustedcomputinggroup.org/about/security/; https://trustedcomputinggroup.org/wp-content/uploads/TCGVRT004-Advisory-FINAL.pdf; https://trustedcomputinggroup.org/about/security/
CVE: CVE-2020-28091
Published: 2020-11-18
Description: cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/160129/xuucms-3-SQL-Injection.html; https://github.com/cbkhwx/cxuucmsv3/issues/1; http://packetstormsecurity.com/files/160129/xuucms-3-SQL-Injection.html
CVE: CVE-2020-28362
Published: 2020-11-18
Description: Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://groups.google.com/g/golang-nuts/c/c-ssaaS7RMI; https://lists.apache.org/thread.html/rd02e75766cd333a0df417588460f5e[PII_REDACTED]000bfe94955851fd%40%3Cissues.trafficcontrol.apache.org%3E; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4COUPL3YVTZ6RTEIT6LPBDJUFF3VSP/
CVE: CVE-2020-28366
Published: 2020-11-18
Description: Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://go.dev/cl/269658; https://go.dev/issue/42559; https://go.googlesource.com/go/+/062e0e5ce6df339dc26732438ad771f73dbf2292
CVE: CVE-2020-28367
Published: 2020-11-18
Description: Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via malicious gcc flags specified via a #cgo directive.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://go.dev/cl/267277; https://go.dev/issue/42556; https://go.googlesource.com/go/+/da7aa86917811a571e6634b45a457f918b8e6561
CVE: CVE-2020-26068
Published: 2020-11-18
Description: A vulnerability in the xAPI service of Cisco Telepresence CE Software and Cisco RoomOS Software could allow an authenticated, remote attacker to generate an access token for an affected device. The vulnerability is due to insufficient access authorization. An attacker could exploit this vulnerability by using the xAPI service to generate a specific token. A successful exploit could allow the attacker to use the generated token to enable experimental features on the device that should not be available to users.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tp-uathracc-jWNESUfM; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-tp-uathracc-jWNESUfM
CVE: CVE-2020-26072
Published: 2020-11-18
Description: A vulnerability in the SOAP API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to access and modify information on devices that belong to a different domain. The vulnerability is due to insufficient authorization in the SOAP API. An attacker could exploit this vulnerability by sending SOAP API requests to affected devices for devices that are outside their authorized domain. A successful exploit could allow the attacker to access and modify information on devices that belong to a different domain.
CVSS Score: 8.7 (HIGH)
CWE: CWE-284, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-AUTH-vEypBmmR; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-AUTH-vEypBmmR
CVE: CVE-2020-26075
Published: 2020-11-18
Description: A vulnerability in the REST API of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to gain access to the back-end database of an affected device. The vulnerability is due to insufficient input validation of REST API requests that are made to an affected device. An attacker could exploit this vulnerability by crafting malicious API requests to the affected device. A successful exploit could allow the attacker to gain access to the back-end database of the affected device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-SQL-zEkBnL2h; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-SQL-zEkBnL2h
CVE: CVE-2020-26076
Published: 2020-11-18
Description: A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected device. The vulnerability is due to the absence of authentication for sensitive information. An attacker could exploit this vulnerability by sending crafted curl commands to an affected device. A successful exploit could allow the attacker to view sensitive database information on the affected device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-497, CWE-200
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-SSI-V2myWX9y; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-SSI-V2myWX9y
CVE: CVE-2020-26077
Published: 2020-11-18
Description: A vulnerability in the access control functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to view lists of users from different domains that are configured on an affected system. The vulnerability is due to improper access control. An attacker could exploit this vulnerability by sending an API request that alters the domain for a requested user list on an affected system. A successful exploit could allow the attacker to view lists of users from different domains on the affected system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-LV-hE4Rntet; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-LV-hE4Rntet
CVE: CVE-2020-26078
Published: 2020-11-18
Description: A vulnerability in the file system of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to overwrite files on an affected system. The vulnerability is due to insufficient file system protections. An attacker could exploit this vulnerability by crafting API requests and sending them to an affected system. A successful exploit could allow the attacker to overwrite files on an affected system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73, CWE-22
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-OVW-SHzOE3Pd; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-OVW-SHzOE3Pd
CVE: CVE-2020-26079
Published: 2020-11-18
Description: A vulnerability in the web UI of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to obtain hashes of user passwords on an affected device. The vulnerability is due to insufficient protection of user credentials. An attacker could exploit this vulnerability by logging in as an administrative user and crafting a call for user information. A successful exploit could allow the attacker to obtain hashes of user passwords on an affected device.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-256, CWE-522
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-PWH-yCA6M7p; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-PWH-yCA6M7p
CVE: CVE-2020-26080
Published: 2020-11-18
Description: A vulnerability in the user management functionality of Cisco IoT Field Network Director (FND) could allow an authenticated, remote attacker to manage user information for users in different domains on an affected system. The vulnerability is due to improper domain access control. An attacker could exploit this vulnerability by manipulating JSON payloads to target different domains on an affected system. A successful exploit could allow the attacker to manage user information for users in different domains on an affected system.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-284, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-UPWD-dCRPuQ78; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-UPWD-dCRPuQ78
CVE: CVE-2020-26081
Published: 2020-11-18
Description: Multiple vulnerabilities in the web UI of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against users on an affected system. The vulnerabilities are due to insufficient validation of user-supplied input that is processed by the web UI. An attacker could exploit these vulnerabilities by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information on an affected system.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74, CWE-74
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-XSS-NzOPCGEc; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-XSS-NzOPCGEc
CVE: CVE-2020-26097
Published: 2020-11-18
Description: The firmware of the PLANET Technology Corp NVR-915 and NVR-1615 before 2020-10-28 embeds default credentials for root access via telnet. By exposing telnet on the Internet, remote root access on the device is possible. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.sec-research.com/[PII_REDACTED]-hard-coded-credentials-in-netzwerk-videorekorder-planet-nvr-915.html; https://www.sec-research.com/[PII_REDACTED]-hard-coded-credentials-in-netzwerk-videorekorder-planet-nvr-915.html
CVE: CVE-2020-27126
Published: 2020-11-18
Description: A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of user-supplied input to an application programmatic interface (API) within Cisco Webex Meetings. An attacker could exploit this vulnerability by convincing a targeted user to follow a link designed to submit malicious input to the API used by Cisco Webex Meetings. A successful exploit could allow the attacker to conduct cross-site scripting attacks and potentially gain access to sensitive browser-based information from the system of a targeted user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-meetings-xss-MX56prER; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-meetings-xss-MX56prER
CVE: CVE-2020-3367
Published: 2020-11-18
Description: A vulnerability in the log subscription subsystem of Cisco AsyncOS for the Cisco Secure Web Appliance (formerly Web Security Appliance) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface and CLI. An attacker could exploit this vulnerability by authenticating to the affected device and injecting scripting commands in the scope of the log subscription subsystem. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-nPzWZrQj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-nPzWZrQj
CVE: CVE-2020-3392
Published: 2020-11-18
Description: A vulnerability in the API of Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive information on an affected system. The vulnerability exists because the affected software does not properly authenticate API calls. An attacker could exploit this vulnerability by sending API requests to an affected system. A successful exploit could allow the attacker to view sensitive information on the affected system, including information about the devices that the system manages, without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-APIA-xZntFS2V; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-APIA-xZntFS2V
CVE: CVE-2020-4592
Published: 2020-11-18
Description: IBM MQ Appliance 9.1.CD and LTS could allow an authenticated user, under nondefault configuration to cause a data corruption attack due to an error when using segmented messages.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184755; https://www.ibm.com/support/pages/node/6359019; https://exchange.xforce.ibmcloud.com/vulnerabilities/184755
CVE: CVE-2020-27695
Published: 2020-11-18
Description: Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10036; https://helpcenter.trendmicro.com/en-us/article/TMKA-10036
CVE: CVE-2020-27696
Published: 2020-11-18
Description: Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product.
CVSS Score: 7.8 (HIGH)
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10036; https://helpcenter.trendmicro.com/en-us/article/TMKA-10036
CVE: CVE-2020-27697
Published: 2020-11-18
Description: Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-10036; https://helpcenter.trendmicro.com/en-us/article/TMKA-10036
CVE: CVE-2020-28572
Published: 2020-11-18
Description: A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege.
CVSS Score: 7.8 (HIGH)
References: https://success.trendmicro.com/solution/000281949; https://success.trendmicro.com/solution/000281949