deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5042
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5043
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5044
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5045
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5046
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5047
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5048
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5049
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5050
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5051
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5052
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5053
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5054
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5055
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5056
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5057
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5058
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5059
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5060
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5061
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5062
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5063
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5064
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5065
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5066
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5067
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5068
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5069
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5070
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5071
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5072
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5073
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5074
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5075
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5076
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5077
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5078
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5079
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5080
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5081
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5082
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5083
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5084
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5085
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5086
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5087
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5088
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5089
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5090
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5091
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5092
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5093
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5094
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5095
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5096
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5097
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5098
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5099
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5100
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2020-5101
Published: 2021-01-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none
CVE: CVE-2019-20483
Published: 2021-01-05
Description: An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.gosecure.net/blog/2020/12/15/vera-stored-xss-improper-access-control/; https://www.gosecure.net/blog/2020/12/15/vera-stored-xss-improper-access-control/
CVE: CVE-2020-29437
Published: 2021-01-05
Description: SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://github.com/orangehrm/orangehrm/issues/695; https://github.com/orangehrm/orangehrm/pull/699; https://github.com/orangehrm/orangehrm/releases
CVE: CVE-2020-36066
Published: 2021-01-05
Description: GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.
CVSS Score: 7.5 (HIGH)
References: https://github.com/tidwall/gjson/issues/195; https://github.com/tidwall/gjson/issues/195
CVE: CVE-2020-36067
Published: 2021-01-05
Description: GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: https://github.com/tidwall/gjson/issues/196; https://github.com/tidwall/gjson/issues/196
CVE: CVE-2019-20484
Published: 2021-01-05
Description: An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly in the browser after logging in.
CVSS Score: 8.1 (HIGH)
CWE: CWE-425
References: https://www.gosecure.net/blog/2020/12/15/vera-stored-xss-improper-access-control/; https://www.gosecure.net/blog/2020/12/15/vera-stored-xss-improper-access-control/
CVE: CVE-2020-23249
Published: 2021-01-05
Description: GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-312
References: https://community.gigamon.com/gigamoncp/s/article/Field-Notice-Gigamon-addressing-multiple-vulnerabilities-in-GigaVUE-OS; https://community.gigamon.com/gigamoncp/s/article/Field-Notice-Gigamon-addressing-multiple-vulnerabilities-in-GigaVUE-OS
CVE: CVE-2020-23250
Published: 2021-01-05
Description: GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database.
CVSS Score: 2.3 (LOW)
CWE: CWE-327
References: https://community.gigamon.com/gigamoncp/s/article/Field-Notice-Gigamon-addressing-multiple-vulnerabilities-in-GigaVUE-OS; https://community.gigamon.com/gigamoncp/s/article/Field-Notice-Gigamon-addressing-multiple-vulnerabilities-in-GigaVUE-OS
CVE: CVE-2020-26181
Published: 2021-01-05
Description: Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE can elevate privileges to the root user if they have ISI PRIV HARDENING privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-269
References: https://www.dell.com/support/security/en-us/details/546720/DSA-2020-227-Dell-EMC-PowerScale-OneFS-and-Dell-EMC-Isilon-OneFS-Security-Update-for-SmartLock-Co; https://www.dell.com/support/security/en-us/details/546720/DSA-2020-227-Dell-EMC-PowerScale-OneFS-and-Dell-EMC-Isilon-OneFS-Security-Update-for-SmartLock-Co
CVE: CVE-2020-26199
Published: 2021-01-05
Description: Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in multiple log files. A local authenticated attacker with access to the log files may use the exposed password to gain access with the privileges of the compromised user.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/kbdoc/000181248; https://www.dell.com/support/kbdoc/000181248
CVE: CVE-2020-29489
Published: 2021-01-05
Description: Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in a system file. A local authenticated attacker with access to the system files may use the exposed password to gain access with the privileges of the compromised user.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-276, CWE-312
References: https://www.dell.com/support/kbdoc/000181248; https://www.dell.com/support/kbdoc/000181248
CVE: CVE-2020-29490
Published: 2021-01-05
Description: Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote authenticated attacker could potentially exploit this vulnerability and cause Denial of Service (Storage Processor Panic) by sending specially crafted UDP requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://www.dell.com/support/kbdoc/000181248; https://www.dell.com/support/kbdoc/000181248
CVE: CVE-2020-29500
Published: 2021-01-05
Description: Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://www.dell.com/support/kbdoc/000180775; https://www.dell.com/support/kbdoc/000180775
CVE: CVE-2020-29501
Published: 2021-01-05
Description: Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://www.dell.com/support/kbdoc/000180775; https://www.dell.com/support/kbdoc/000180775
CVE: CVE-2020-29502
Published: 2021-01-05
Description: Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://www.dell.com/support/kbdoc/000180775; https://www.dell.com/support/kbdoc/000180775
CVE: CVE-2020-35170
Published: 2021-01-05
Description: Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users’ sessions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.dell.com/support/kbdoc/000181212; https://www.dell.com/support/kbdoc/000181212
CVE: CVE-2020-36051
Published: 2021-01-05
Description: Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/bg5sbk/MiniCMS/issues/39; https://github.com/bg5sbk/MiniCMS/issues/39
CVE: CVE-2020-36052
Published: 2021-01-05
Description: Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/bg5sbk/MiniCMS/issues/38; https://github.com/bg5sbk/MiniCMS/issues/38
CVE: CVE-2020-7336
Published: 2021-01-05
Description: Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10341; https://kc.mcafee.com/corporate/index?page=content&id=SB10341
CVE: CVE-2021-3026
Published: 2021-01-05
Description: Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://invisioncommunity.com/release-notes/; https://invisioncommunity.com/release-notes/
CVE: CVE-2020-36160
Published: 2021-01-06
Description: An issue was discovered in Veritas System Recovery before 21.2. On start-up, it loads the OpenSSL library from \usr\local\ssl. This library attempts to load the from \usr\local\ssl\openssl.cnf configuration file, which does not exist. By default, on Windows systems, users can create directories under C:\. A low privileged user can create a C:\usr\local\ssl\openssl.cnf configuration file to load a malicious OpenSSL engine, resulting in arbitrary code execution as SYSTEM when the service starts. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data and installed applications, etc. If the system is also an Active Directory domain controller, then this can affect the entire domain.
CVSS Score: 9.3 (CRITICAL)
References: https://www.veritas.com/content/support/en_US/security/VTS20-017; https://www.veritas.com/content/support/en_US/security/VTS20-017
CVE: CVE-2020-36161
Published: 2021-01-06
Description: An issue was discovered in Veritas APTARE 10.4 before 10.4P9 and 10.5 before 10.5P3. By default, on Windows systems, users can create directories under C:\. A low privileged user can create a directory at the configuration file locations. When the Windows system restarts, a malicious OpenSSL engine could exploit arbitrary code execution as SYSTEM. This gives the attacker administrator access on the system, allowing the attacker (by default) to access all data, access all installed applications, etc.
CVSS Score: 8.8 (HIGH)
References: https://www.veritas.com/content/support/en_US/security/VTS20-009; https://www.veritas.com/content/support/en_US/security/VTS20-009