deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-24496
Published: 2021-02-17
Description: Insufficient input validation in the firmware for Intel(R) 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html
CVE: CVE-2020-24497
Published: 2021-02-17
Description: Insufficient Access Control in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html
CVE: CVE-2020-24498
Published: 2021-02-17
Description: Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html
CVE: CVE-2020-24500
Published: 2021-02-17
Description: Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable a denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html
CVE: CVE-2020-24501
Published: 2021-02-17
Description: Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html
CVE: CVE-2020-24502
Published: 2021-02-17
Description: Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
CVE: CVE-2020-24503
Published: 2021-02-17
Description: Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
CVE: CVE-2020-24504
Published: 2021-02-17
Description: Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00462.html
CVE: CVE-2020-24505
Published: 2021-02-17
Description: Insufficient input validation in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00456.html
CVE: CVE-2020-7848
Published: 2021-02-17
Description: The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can send a GET request that executes arbitrary OS commands via cookie value.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-77
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35905; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35905
CVE: CVE-2020-7849
Published: 2021-02-17
Description: A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient input(server domain) validation. An attacker could exploit this vulnerability through crafted URL.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20, CWE-20
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35903; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35903
CVE: CVE-2020-8678
Published: 2021-02-17
Description: Improper access control for Intel(R) Graphics Drivers before version 15.45.33.5164 and 27.20.100.8280 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00438.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00438.html
CVE: CVE-2020-8701
Published: 2021-02-17
Description: Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00457.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00457.html
CVE: CVE-2020-8765
Published: 2021-02-17
Description: Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00397.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00397.html
CVE: CVE-2021-0109
Published: 2021-02-17
Description: Insecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version 604 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00471.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00471.html
CVE: CVE-2021-22853
Published: 2021-02-17
Description: The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e; https://www.twcert.org.tw/tw/cp-132-4403-8eb68-1.html; https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e
CVE: CVE-2021-22854
Published: 2021-02-17
Description: The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e; https://www.twcert.org.tw/tw/cp-132-4404-3f498-1.html; https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e
CVE: CVE-2021-22855
Published: 2021-02-17
Description: The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e; https://www.twcert.org.tw/tw/cp-132-4405-2ddde-1.html; https://www.chtsecurity.com/news/d334641f-2b28-4eab-a5ed-c6ec6740557e
CVE: CVE-2020-12365
Published: 2021-02-17
Description: Untrusted pointer dereference in some Intel(R) Graphics Drivers before versions 15.33.51.5146, 15.45.32.5145, 15.36.39.5144 and 15.40.46.5143 may allow an authenticated user to potentially denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00438.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00438.html
CVE: CVE-2020-35339
Published: 2021-02-17
Description: In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.74cms.com/download/index.html; https://github.com/BigTiger2020/74cms-rce/blob/main/README.md; http://www.74cms.com/download/index.html
CVE: CVE-2020-36002
Published: 2021-02-17
Description: Seat-Reservation-System 1.0 has a SQL injection vulnerability in index.php in the id parameter where attackers can obtain sensitive database information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/BigTiger2020/Seat-Reservation-System; https://www.sourcecodester.com/php/14452/seat-reservation-system-movie-theater-project-using-phpmysql.htm; https://www.sourcecodester.com/sites/default/files/download/oretnom23/seat-reservation-system-using-php_0.zip
CVE: CVE-2020-36003
Published: 2021-02-17
Description: The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/TCSWT/Online-Book-Store/blob/main/Online-Book-Store.md; https://www.sourcecodester.com/download-code?nid=14383&title=Online+Book+Store; https://www.sourcecodester.com/php/14383/online-book-store.html
CVE: CVE-2021-22173
Published: 2021-02-17
Description: Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file
CVSS Score: 3.7 (LOW)
CWE: CWE-401
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22173.json; https://gitlab.com/wireshark/wireshark/-/issues/17124; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GND3PIQC3KZALR227V4YUMPKJBA5BZG4/
CVE: CVE-2021-22174
Published: 2021-02-17
Description: Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file
CVSS Score: 3.7 (LOW)
CWE: CWE-770
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22174.json; https://gitlab.com/wireshark/wireshark/-/issues/17165; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GND3PIQC3KZALR227V4YUMPKJBA5BZG4/
CVE: CVE-2021-25779
Published: 2021-02-17
Description: Baby Care System v1.0 is vulnerable to SQL injection via the 'id' parameter on the contentsectionpage.php page.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/TCSWT/Baby-Care-System/blob/main/README.md; https://github.com/TCSWT/Baby-Care-System/blob/main/README.md
CVE: CVE-2021-25780
Published: 2021-02-17
Description: An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/TCSWT/Baby-Care-System/blob/main/README.md; https://github.com/TCSWT/Baby-Care-System/blob/main/README.md
CVE: CVE-2021-26559
Published: 2021-02-17
Description: Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.openwall.com/lists/oss-security/2021/02/17/1; https://lists.apache.org/thread.html/r3b[PII_REDACTED]ec361308cbefb7c2cce2acb26891a12ce864e4a13c8d%40%3Cusers.airflow.apache.org%3E; https://lists.apache.org/thread.html/rd142565996d7ee847b9c14b8a9921dcf80bc6bc160e3d9dca6dfc2f8%40%3Cannounce.apache.org%3E
CVE: CVE-2021-26697
Published: 2021-02-17
Description: The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-269, CWE-306
References: http://www.openwall.com/lists/oss-security/2021/02/17/2; https://lists.apache.org/thread.html/r36111262a59219a3e2704c71e97cf84937dae5ba7a1da99499e5d8f9%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/re21fec81baea7a6d73b0b5d31efd07cc02c61f832e297f65bb19b519%40%3Cdev.airflow.apache.org%3E
CVE: CVE-2021-26809
Published: 2021-02-17
Description: PHPGurukul Car Rental Project version 2.0 suffers from a remote shell upload vulnerability in changeimage1.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://packetstormsecurity.com/files/161267/Car-Rental-Project-2.0-Shell-Upload.html; https://www.exploit-db.com/exploits/49520; https://packetstormsecurity.com/files/161267/Car-Rental-Project-2.0-Shell-Upload.html
CVE: CVE-2021-27224
Published: 2021-02-17
Description: The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x[PII_REDACTED]012ec6, which might allow remote attackers to execute arbitrary code.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/161449/IrfanView-4.57-Denial-Of-Service-Code-Execution.html; https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-irfanview-wpg/; https://www.irfanview.com/plugins.htm
CVE: CVE-2021-27362
Published: 2021-02-17
Description: The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a Read Access Violation on Control Flow starting at WPG!ReadWPG_W+0x[PII_REDACTED]000133, which might allow remote attackers to execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-irfanview-wpg/; https://www.irfanview.com/plugins.htm; https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-irfanview-wpg/
CVE: CVE-2021-1351
Published: 2021-02-17
Description: A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-Lz6HbGCt; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-Lz6HbGCt
CVE: CVE-2021-1366
Published: 2021-02-17
Description: A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-347, CWE-427
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-hijac-JrcTOQMC; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-dll-hijac-JrcTOQMC
CVE: CVE-2021-1372
Published: 2021-02-17
Description: A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. Note: To exploit this vulnerability, an attacker must have valid credentials on a Microsoft Windows end-user system and must log in after another user has already authenticated with Webex on the same end-user system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-202
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wda-pt-msh-6LWOcZ5; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wda-pt-msh-6LWOcZ5
CVE: CVE-2021-1378
Published: 2021-02-17
Description: A vulnerability in the SSH service of the Cisco StarOS operating system could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error that may occur under specific traffic conditions. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to prevent the targeted service from receiving any traffic, which would lead to a DoS condition on the affected device.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-StarOS-DoS-RLLvGFJj; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-StarOS-DoS-RLLvGFJj
CVE: CVE-2021-1412
Published: 2021-02-17
Description: Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only administrator access to the Admin portal could exploit these vulnerabilities by browsing to one of the pages that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S
CVE: CVE-2021-1416
Published: 2021-02-17
Description: Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only administrator access to the Admin portal could exploit these vulnerabilities by browsing to one of the pages that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system. For more information about these vulnerabilities, see the Details section of this advisory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-266, CWE-269
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-exp-8RsuEu8S
CVE: CVE-2020-13550
Published: 2021-02-17
Description: A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-22, CWE-22
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1168; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1168
CVE: CVE-2020-13551
Published: 2021-02-17
Description: An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via PostgreSQL executable, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169
CVE: CVE-2020-13552
Published: 2021-02-17
Description: An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via multiple service executables in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169
CVE: CVE-2020-13553
Published: 2021-02-17
Description: An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169
CVE: CVE-2020-13555
Published: 2021-02-17
Description: An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In COM Server Application Privilege Escalation, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169