deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11877
Published: 2020-04-17
Description: airhost.exe in Zoom Client for Meetings 4.6.11 uses [PII_REDACTED] as the Initialization Vector (IV) for AES-256 CBC encryption. NOTE: the vendor states that this IV is used only within unreachable code
CVSS Score: 7.5 (HIGH)
CWE: CWE-330, CWE-330
References: https://dev.io/posts/zoomzoo/; https://dev.io/posts/zoomzoo/
CVE: CVE-2020-11878
Published: 2020-04-17
Description: The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANGELOG.md#stable-4384-1; https://github.com/jitsi/docker-jitsi-meet/compare/stable-4384...stable-4384-1; https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANGELOG.md#stable-4384-1
CVE: CVE-2019-6203
Published: 2020-04-17
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged network position may be able to intercept network traffic.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/HT209599; https://support.apple.com/HT209600; https://support.apple.com/HT209601
CVE: CVE-2020-10178
Published: 2020-04-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-11637. Reason: This candidate is a reservation duplicate of CVE-2020-11637. Notes: All CVE users should reference CVE-2020-11637 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-11879
Published: 2020-04-17
Description: An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.
CVSS Score: 6.5 (MEDIUM)
References: https://gitlab.gnome.org/GNOME/evolution/-/blob/master/NEWS; https://gitlab.gnome.org/GNOME/evolution/issues/784; https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf
CVE: CVE-2020-11880
Published: 2020-04-17
Description: An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value.
CVSS Score: 6.5 (MEDIUM)
References: https://cgit.kde.org/kmail.git/commit/?id=2a348eccd352260f192d9b449492071bbf2b34b1; https://cgit.kde.org/kmail.git/tag/?h=v19.12.3; https://cgit.kde.org/kmail.git/commit/?id=2a348eccd352260f192d9b449492071bbf2b34b1
CVE: CVE-2020-7079
Published: 2020-04-17
Description: An improper signature validation vulnerability in Autodesk Dynamo BIM versions 2.5.1 and 2.5.0 may lead to code execution through maliciously crafted DLL files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0001; https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0001
CVE: CVE-2020-7080
Published: 2020-04-17
Description: A buffer overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitrary code execution on a system running it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002
CVE: CVE-2020-7081
Published: 2020-04-17
Description: A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system running it.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002
CVE: CVE-2020-7082
Published: 2020-04-17
Description: A use-after-free vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to code execution on a system running it.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002
CVE: CVE-2020-7083
Published: 2020-04-17
Description: An intager overflow vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002
CVE: CVE-2020-7084
Published: 2020-04-17
Description: A NULL pointer dereference vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to denial of service of the application.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002
CVE: CVE-2020-7085
Published: 2020-04-17
Description: A heap overflow vulnerability in the Autodesk FBX-SDK versions 2019.2 and earlier may lead to arbitrary code execution on a system running it.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002; https://www.autodesk.com/trust/security-advisories/adsk-sa-2020-0002
CVE: CVE-2019-2056
Published: 2020-04-17
Description: There is a possible disclosure of RAM using a shared crypto key due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-140879284
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0067
Published: 2020-04-17
Description: In f2fs_xattr_generic_list of xattr.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not required for exploitation.Product: Android. Versions: Android kernel. Android ID: A-120551147.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: http://android.googlesource.com/kernel/common/+/688078e7; http://packetstormsecurity.com/files/159565/Kernel-Live-Patch-Security-Notice-LSN-0072-1.html; https://source.android.com/security/bulletin/pixel/2020-04-01
CVE: CVE-2020-0068
Published: 2020-04-17
Description: In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: Android. Versions: Android kernel. Android ID: A-139354541
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://source.android.com/security/bulletin/pixel/2020-04-01; https://source.android.com/security/bulletin/pixel/2020-04-01
CVE: CVE-2020-0070
Published: 2020-04-17
Description: In rw_t2t_update_lock_attributes of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148159613
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0071
Published: 2020-04-17
Description: In rw_t2t_extract_default_locks_info of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147310721
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0072
Published: 2020-04-17
Description: In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147310271
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0073
Published: 2020-04-17
Description: In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147309942
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0075
Published: 2020-04-17
Description: In set_shared_key of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-146057864
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0076
Published: 2020-04-17
Description: In get_auth_result of the FPC IRIS TrustZone app, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-146056878
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0077
Published: 2020-04-17
Description: In authorize_enroll of the FPC IRIS TrustZone app, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-146055840
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0078
Published: 2020-04-17
Description: In releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-144766455
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0079
Published: 2020-04-17
Description: In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to stale pointer. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-144506242
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0080
Published: 2020-04-17
Description: In onOpActiveChanged and related methods of AppOpsControllerImpl.java, there is a possible way to display an app overlaying other apps without the notification icon that it's overlaying. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-144092031
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-0081
Published: 2020-04-17
Description: In finalize of AssetManager.java, there is possible memory corruption due to a double free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144028297
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/; https://source.android.com/security/bulletin/2020-04-01; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC6HLX5SG4PZO6Y54D2LFJ4ATG76BKOP/
CVE: CVE-2020-0082
Published: 2020-04-17
Description: In ExternalVibration of ExternalVibration.java, there is a possible activation of an arbitrary intent due to unsafe deserialization. This could lead to local escalation of privilege to system_server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-140417434
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://source.android.com/security/bulletin/2020-04-01; https://source.android.com/security/bulletin/2020-04-01
CVE: CVE-2020-11883
Published: 2020-04-17
Description: In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209
References: https://github.com/DivanteLtd/storefront-api/pull/59; https://github.com/DivanteLtd/vue-storefront-api/pull/431; https://github.com/DivanteLtd/storefront-api/pull/59
CVE: CVE-2020-1751
Published: 2020-04-17
Description: An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751; https://security.gentoo.org/glsa/202006-04; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-5728
Published: 2020-04-17
Description: OpenMRS 2.9 and prior copies "Referrer" header values into an html element named "redirectUrl" within many webpages (such as login.htm). There is insufficient validation for this parameter, which allows for the possibility of cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-79
References: https://www.tenable.com/security/research/tra-2020-18; https://www.tenable.com/security/research/tra-2020-18
CVE: CVE-2020-5729
Published: 2020-04-17
Description: In OpenMRS 2.9 and prior, the UI Framework Error Page reflects arbitrary, user-supplied input back to the browser, which can result in XSS. Any page that is able to trigger a UI Framework Error is susceptible to this issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-18; https://www.tenable.com/security/research/tra-2020-18
CVE: CVE-2020-5730
Published: 2020-04-17
Description: In OpenMRS 2.9 and prior, the sessionLocation parameter for the login page is vulnerable to cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-18; https://www.tenable.com/security/research/tra-2020-18
CVE: CVE-2020-5731
Published: 2020-04-17
Description: In OpenMRS 2.9 and prior, the app parameter for the ActiveVisit's page is vulnerable to cross-site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-18; https://www.tenable.com/security/research/tra-2020-18
CVE: CVE-2020-5732
Published: 2020-04-17
Description: In OpenMRS 2.9 and prior, he import functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows unauthenticated users to use a feature typically restricted to administrators.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.tenable.com/security/research/tra-2020-18; https://www.tenable.com/security/research/tra-2020-18
CVE: CVE-2020-5733
Published: 2020-04-17
Description: In OpenMRS 2.9 and prior, the export functionality of the Data Exchange Module does not properly redirect to a login page when an unauthenticated user attempts to access it. This allows the export of potentially sensitive information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://www.tenable.com/security/research/tra-2020-18; https://www.tenable.com/security/research/tra-2020-18
CVE: CVE-2020-5737
Published: 2020-04-17
Description: Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/tns-2020-02; https://www.tenable.com/security/tns-2020-02
CVE: CVE-2020-11885
Published: 2020-04-17
Description: WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611, CWE-918
References: https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0684; https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0684
CVE: CVE-2020-11886
Published: 2020-04-17
Description: OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://issues.opennms.org/browse/NMS-12572; https://issues.opennms.org/browse/NMS-12572
CVE: CVE-2020-11887
Published: 2020-04-17
Description: svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/domenic/svg2png/issues/117; https://github.com/domenic/svg2png/issues/117
CVE: CVE-2020-11894
Published: 2020-04-19
Description: Ming (aka libming) 0.4.8 has a heap-based buffer over-read (8 bytes) in the function decompileIF() in decompile.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/libming/libming/issues/196; https://github.com/libming/libming/issues/196
CVE: CVE-2020-11895
Published: 2020-04-19
Description: Ming (aka libming) 0.4.8 has a heap-based buffer over-read (2 bytes) in the function decompileIF() in decompile.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://github.com/libming/libming/issues/197; https://github.com/libming/libming/issues/197
CVE: CVE-2019-20786
Published: 2020-04-19
Description: handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/pion/dtls/commit/fd73a5df2ff0e1fb6ae6a51e2777d7a16cc4f4e0; https://github.com/pion/dtls/compare/v1.5.1...v1.5.2; https://www.usenix.org/conference/usenixsecurity20/presentation/fiterau-brostean
CVE: CVE-2020-11928
Published: 2020-04-20
Description: In the media-library-assistant plugin before 2.82 for WordPress, Remote Code Execution can occur via the tax_query, meta_query, or date_query parameter in mla_gallery via an admin.
CVSS Score: 9.8 (CRITICAL)
References: https://wordpress.org/plugins/media-library-assistant/#developers; https://wordpress.org/plugins/media-library-assistant/#developers
CVE: CVE-2020-11930
Published: 2020-04-20
Description: The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/2245581/gtranslate; https://plugins.trac.wordpress.org/changeset/2245591/gtranslate; https://wordpress.org/plugins/gtranslate/#developers
CVE: CVE-2020-5569
Published: 2020-04-20
Description: An unquoted search path vulnerability exists in HDD Password tool (for Windows) version 1.20.6620 and earlier which is stored in CANVIO PREMIUM 3TB(HD-MB30TY, HD-MA30TY, HD-MB30TS, HD-MA30TS), CANVIO PREMIUM 2TB(HD-MB20TY, HD-MA20TY, HD-MB20TS, HD-MA20TS), CANVIO PREMIUM 1TB(HD-MB10TY, HD-MA10TY, HD-MB10TS, HD-MA10TS), CANVIO SLIM 1TB(HD-SB10TK, HD-SB10TS), and CANVIO SLIM 500GB(HD-SB50GK, HD-SA50GK, HD-SB50GS, HD-SA50GS), and which was downloaded before 2020 May 10. Since it registers Windows services with unquoted file paths, when a registered path contains spaces, and a malicious executable is placed on a certain path, it may be executed with the privilege of the Windows service.
CVSS Score: 8.4 (HIGH)
CWE: CWE-428
References: https://jvn.jp/en/jp/JVN13467854/index.html; https://www.canvio.jp/news/20200420.htm; https://jvn.jp/en/jp/JVN13467854/index.html
CVE: CVE-2017-18851
Published: 2020-04-20
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D8500 through 1.0.3.28, R6400 through 1.0.1.22, R6400v2 through 1.0.2.18, R8300 through 1.0.2.94, R8500 through 1.0.2.94, and R6100 through 1.0.1.12.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-74
References: https://kb.netgear.com/000045850/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Modem-Routers-PSV-2017-1207; https://kb.netgear.com/000045850/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Modem-Routers-PSV-2017-1207
CVE: CVE-2017-18852
Published: 2020-04-20
Description: Certain NETGEAR devices are affected by CSRF and authentication bypass. This affects R7300DST before 1.0.0.54, R8300 before 1.0.2.100_1.0.82, R8500 before 1.0.2.100_1.0.82, and WNDR3400v3 before 1.0.1.14.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000045849/Security-Advisory-for-CSRF-and-Authentication-Bypass-on-Some-Routers-PSV-2017-1206; https://kb.netgear.com/000045849/Security-Advisory-for-CSRF-and-Authentication-Bypass-on-Some-Routers-PSV-2017-1206