deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6479
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6480
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6481
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6482
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6483
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6484
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6485
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6486
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6487
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6488
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6489
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6490
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6491
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2012-6492
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none
CVE: CVE-2013-0802
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2013-1703
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none
CVE: CVE-2020-13983
Published: 2020-07-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-14159. Reason: This candidate is a reservation duplicate of CVE-2020-14159. Notes: All CVE users should reference CVE-2020-14159 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-8181
Published: 2020-07-10
Description: A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-840, CWE-434
References: https://hackerone.com/reports/808287%2C; https://nextcloud.com/security/advisory/?id=NC-SA-2020-024; https://hackerone.com/reports/808287%2C
CVE: CVE-2020-8186
Published: 2020-07-10
Description: A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `certificateFor` function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://hackerone.com/reports/863544; https://hackerone.com/reports/863544
CVE: CVE-2020-8187
Published: 2020-07-10
Description: Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-20
References: https://support.citrix.com/article/CTX276688; https://support.citrix.com/article/CTX276688
CVE: CVE-2020-8190
Published: 2020-07-10
Description: Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://support.citrix.com/article/CTX276688; https://support.citrix.com/article/CTX276688
CVE: CVE-2020-8191
Published: 2020-07-10
Description: Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.citrix.com/article/CTX276688; https://support.citrix.com/article/CTX276688
CVE: CVE-2020-8193
Published: 2020-07-10
Description: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows unauthenticated access to certain URL endpoints.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-287
References: http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html; https://support.citrix.com/article/CTX276688; http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html
CVE: CVE-2020-8194
Published: 2020-07-10
Description: Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows the modification of a file download.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://support.citrix.com/article/CTX276688; https://support.citrix.com/article/CTX276688
CVE: CVE-2020-8195
Published: 2020-07-10
Description: Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-22
References: http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html; https://support.citrix.com/article/CTX276688; http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html
CVE: CVE-2020-8196
Published: 2020-07-10
Description: Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in limited information disclosure to low privileged users.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-287
References: http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html; https://support.citrix.com/article/CTX276688; http://packetstormsecurity.com/files/160047/Citrix-ADC-NetScaler-Local-File-Inclusion.html
CVE: CVE-2020-8197
Published: 2020-07-10
Description: Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands.
CVSS Score: 8.8 (HIGH)
References: https://support.citrix.com/article/CTX276688; https://support.citrix.com/article/CTX276688
CVE: CVE-2020-8198
Published: 2020-07-10
Description: Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in Stored Cross-Site Scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.citrix.com/article/CTX276688; https://support.citrix.com/article/CTX276688
CVE: CVE-2020-8199
Published: 2020-07-10
Description: Improper access control in Citrix ADC Gateway Linux client versions before 1.0.0.137 results in local privilege escalation to root.
CVSS Score: 7.8 (HIGH)
References: https://support.citrix.com/article/CTX276688; https://support.citrix.com/article/CTX276688
CVE: CVE-2020-15504
Published: 2020-07-10
Description: A SQL injection vulnerability in the user and admin web interfaces of Sophos XG Firewall v18.0 MR1 and older potentially allows an attacker to run arbitrary code remotely. The fix is built into the re-release of XG Firewall v18 MR-1 (named MR-1-Build396) and the v17.5 MR13 release. All other versions >= 17.0 have received a hotfix.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-via-sqli-cve-2020-15504; https://community.sophos.com/b/security-blog/posts/advisory-resolved-rce-via-sqli-cve-2020-15504
CVE: CVE-2020-6114
Published: 2020-07-10
Description: An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1067; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1067
CVE: CVE-2020-11081
Published: 2020-07-10
Description: osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables local escalation. This is fixed in version 4.4.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-114, CWE-426
References: https://github.com/osquery/osquery/commit/4d4957f12a6aa0becc9d01d9f97061e1e3d809c5; https://github.com/osquery/osquery/issues/6426; https://github.com/osquery/osquery/pull/6433
CVE: CVE-2020-11061
Published: 2020-07-10
Description: In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in Bareos versions 19.2.8, 18.2.9 and 17.2.10.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-122, CWE-787
References: https://bugs.bareos.org/view.php?id=1210; https://github.com/bareos/bareos/security/advisories/GHSA-mm45-cg35-54j4; https://lists.debian.org/debian-lts-announce/2020/08/msg00051.html
CVE: CVE-2020-4042
Published: 2020-07-10
Description: Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to the director itself leading to the director responding to the replayed challenge. The response obtained is then a valid reply to the directors original challenge. This is fixed in version 19.2.8.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-294, CWE-294
References: https://bugs.bareos.org/view.php?id=1250; https://github.com/bareos/bareos/security/advisories/GHSA-vqpj-2vhj-h752; https://bugs.bareos.org/view.php?id=1250
CVE: CVE-2020-15105
Published: 2020-07-10
Description: Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password and then leaves before entering their two-factor authentication code. The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' passwords are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of using Django's cache session store, the users' passwords are stored in clear text in whatever cache storage you have configured (typically Memcached or Redis). This has been fixed in 1.12. After upgrading, users should be sure to delete any clear text passwords that have been stored. For example, if you're using the database session backend, you'll likely want to delete any session record from the database and purge that data from any database backups or replicas. In addition, affected organizations who have suffered a database breach while using an affected version should inform their users that their clear text passwords have been compromised. All organizations should encourage users whose passwords were insecurely stored to change these passwords on any sites where they were used. As a workaround, wwitching Django's session storage to use signed cookies instead of the database or cache lessens the impact of this issue, but should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than a server-side session storage. There is no way to fully mitigate the issue without upgrading.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://github.com/Bouke/django-two-factor-auth/blob/master/CHANGELOG.md#112---2020-07-08; https://github.com/Bouke/django-two-factor-auth/commit/454fd9842fa6e8bb772dbf0943976bc8e3335359; https://github.com/Bouke/django-two-factor-auth/security/advisories/GHSA-vhr6-pvjm-9qwf
CVE: CVE-2019-20897
Published: 2020-07-13
Description: The avatar upload feature in affected versions of Atlassian Jira Server and Data Center allows remote attackers to achieve Denial of Service via a crafted PNG file. The affected versions are before version 8.5.4, from version 8.6.0 before 8.6.2, and from version 8.7.0 before 8.7.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434
References: https://jira.atlassian.com/browse/JRASERVER-70813; https://jira.atlassian.com/browse/JRASERVER-70813
CVE: CVE-2019-20898
Published: 2020-07-13
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
CVSS Score: 7.5 (HIGH)
References: https://jira.atlassian.com/browse/JRASERVER-70942; https://jira.atlassian.com/browse/JRASERVER-70942
CVE: CVE-2019-20899
Published: 2020-07-13
Description: The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.
CVSS Score: 5.3 (MEDIUM)
References: https://jira.atlassian.com/browse/JRASERVER-70808; https://jira.atlassian.com/browse/JRASERVER-70808
CVE: CVE-2019-20900
Published: 2020-07-13
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/JRASERVER-70858; https://jira.atlassian.com/browse/JRASERVER-70858
CVE: CVE-2019-20901
Published: 2020-07-13
Description: The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://jira.atlassian.com/browse/JRASERVER-70408; https://jira.atlassian.com/browse/JRASERVER-70408
CVE: CVE-2020-14174
Published: 2020-07-13
Description: Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5.7, from version 8.6.0 before 8.9.2, and from version 8.10.0 before 8.10.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://jira.atlassian.com/browse/JRASERVER-71275; https://jira.atlassian.com/browse/JRASERVER-71275
CVE: CVE-2019-20907
Published: 2020-07-13
Description: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00051.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00052.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00053.html
CVE: CVE-2019-4591
Published: 2020-07-13
Description: IBM Maximo Asset Management 7.6.0 and 7.6.1 does not invalidate session after logout which could allow a local user to impersonate another user on the system. IBM X-Force ID: 167451.
CVSS Score: 7.8 (HIGH)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/167451; https://www.ibm.com/support/pages/node/6245696; https://exchange.xforce.ibmcloud.com/vulnerabilities/167451
CVE: CVE-2020-15689
Published: 2020-07-13
Description: Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/embedthis/appweb-gpl/issues/2; https://github.com/embedthis/appweb-gpl/issues/2
CVE: CVE-2020-11749
Published: 2020-07-13
Description: Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS), which can run arbitrary code to allow Remote Code Execution as root or apache2.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://medium.com/%40tehwinsam/multiple-xss-on-pandorafms-7-0-ng-744-64b244b8523c; https://packetstormsecurity.com/files/158389/Pandora-FMS-7.0-NG-746-Script-Insertion-Code-Execution.htmlPoC; https://pandorafms.com/downloads/whats-new-747-EN.pdf
CVE: CVE-2020-5766
Published: 2020-07-13
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SRS Simple Hits Counter Plugin for WordPress 1.0.3 and 1.0.4 allows a remote, unauthenticated attacker to determine the value of database fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://www.tenable.com/security/research/tra-2020-42; https://www.tenable.com/security/research/tra-2020-42
CVE: CVE-2019-19338
Published: 2020-07-13
Description: A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203, CWE-385, CWE-203
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19338; https://software.intel.com/security-software-guidance/insights/deep-dive-intel-transactional-synchronization-extensions-intel-tsx-asynchronous-abort; https://www.openwall.com/lists/oss-security/2019/12/10/3
CVE: CVE-2020-10986
Published: 2020-07-13
Description: A CSRF issue in the /goform/SysToolReboot endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to reboot the device and cause denial of service via a payload hosted by an attacker-controlled web page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68; https://www.ise.io/research/; https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE: CVE-2020-10987
Published: 2020-07-13
Description: The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68; https://www.ise.io/research/; https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE: CVE-2020-10988
Published: 2020-07-13
Description: A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a telnetd service on the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68; https://www.ise.io/research/; https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE: CVE-2020-10989
Published: 2020-07-13
Description: An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68; https://www.ise.io/research/; https://blog.securityevaluators.com/tenda-ac1900-vulnerabilities-discovered-and-exploited-e8e26aa0bc68
CVE: CVE-2020-14298
Published: 2020-07-13
Description: The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.
CVSS Score: 8.8 (HIGH)
CWE: CWE-273
References: https://access.redhat.com/errata/RHBA-2020:0427; https://access.redhat.com/security/cve/CVE-2020-14298; https://access.redhat.com/security/vulnerabilities/runcescape