deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-18868
Published: 2020-05-07
Description: Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-312, CWE-522
References: https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md; https://lodestonesecurity.com; https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE: CVE-2020-5894
Published: 2020-05-07
Description: On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: https://support.f5.com/csp/article/K13028514; https://support.f5.com/csp/article/K13028514
CVE: CVE-2020-5895
Published: 2020-05-07
Description: On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K95120415; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-6081
Published: 2020-05-07
Description: An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1003; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1003
CVE: CVE-2019-18864
Published: 2020-05-07
Description: /server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host machine.
CVSS Score: 7.5 (HIGH)
References: https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md; https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE: CVE-2019-18866
Published: 2020-05-07
Description: Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data from the rkc database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md; https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE: CVE-2019-18869
Published: 2020-05-07
Description: Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md; https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE: CVE-2019-18870
Published: 2020-05-07
Description: A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md; https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE: CVE-2019-18871
Published: 2020-05-07
Description: A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md; https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE: CVE-2019-18872
Published: 2020-05-07
Description: Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234).
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md; https://github.com/lodestone-security/CVEs/blob/master/remote_kiln_control/an_unfortunate_kilnundrum.md
CVE: CVE-2020-7473
Published: 2020-05-07
Description: In certain situations, all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, allow unauthenticated attackers to access the documents and folders of ShareFile users. NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-8982 and CVE-2020-8983 but has essentially the same risk.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://support.citrix.com/article/CTX269106; https://support.citrix.com/article/CTX269106
CVE: CVE-2020-8982
Published: 2020-05-07
Description: An unauthenticated arbitrary file read issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8983.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://drive.google.com/file/d/1Izd5MF_HHuq8YSwAyJLBErWL_nbe6f9v/view; https://support.citrix.com/article/CTX269106; https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity[PII_REDACTED]455025152-8_w6/
CVE: CVE-2020-8983
Published: 2020-05-07
Description: An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller, including the most recent 5.10.x releases as of May 2020, which allows remote code execution. RCE and file access is granted to everything hosted by ShareFile, be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs, exploitability depends on the product version that was in use when a particular setup step was performed, NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically, the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0, 5.8.0, 5.7.0, 5.6.0, 5.5.0, or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8982.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://drive.google.com/file/d/15iy6S8CN9Hku0a2zrcrXK9FAocmQvMwT/view?usp=sharing; https://support.citrix.com/article/CTX269106; https://www.linkedin.com/posts/jonas-hansen-2a2606b_citrix-sharefile-storage-zones-controller-activity[PII_REDACTED]455025152-8_w6/
CVE: CVE-2020-12683
Published: 2020-05-07
Description: Katyshop2 before 2.12 has multiple stored XSS issues.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sourceforge.net/p/katyshop2/code/ci/8c6fb8d8df410e34b704e567805308d820ca5eae/; https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-001; https://sourceforge.net/p/katyshop2/code/ci/8c6fb8d8df410e34b704e567805308d820ca5eae/
CVE: CVE-2020-12687
Published: 2020-05-07
Description: An issue was discovered in Serpico before 1.3.3. The /admin/attacments_backup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users (including administrators) from the database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-668
References: https://github.com/SerpicoProject/Serpico/commit/0b[PII_REDACTED]a5ad733604c7b1428071baf239c2; https://github.com/SerpicoProject/Serpico/releases/tag/1.3.3; https://github.com/SerpicoProject/Serpico/commit/0b[PII_REDACTED]a5ad733604c7b1428071baf239c2
CVE: CVE-2020-6651
Published: 2020-05-07
Description: Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20, CWE-78
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-649/; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
CVE: CVE-2020-6652
Published: 2020-05-07
Description: Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-266, CWE-269
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf; https://www.zerodayinitiative.com/advisories/ZDI-20-650/; https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf
CVE: CVE-2020-11431
Published: 2020-05-07
Description: The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases/changes_19.2; https://www.inetsoftware.de/support/news/i-net-clear-reports-security-advisory-2020-apr-06; https://www.inetsoftware.de/support/news/i-net-helpdesk-sicherheitsankuendigung-2020-apr-06
CVE: CVE-2020-12448
Published: 2020-05-07
Description: GitLab EE 12.8 and later allows Exposure of Sensitive Information to an Unauthorized Actor via NuGet.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://about.gitlab.com/blog/categories/releases/; https://about.gitlab.com/releases/2020/04/30/security-release-12-10-2-released/; https://about.gitlab.com/blog/categories/releases/
CVE: CVE-2020-12608
Published: 2020-05-07
Description: An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://packetstormsecurity.com/files/157591/SolarWinds-MSP-PME-Cache-Service-Insecure-File-Permissions-Code-Execution.html; http://seclists.org/fulldisclosure/2020/May/23; https://github.com/jensregel/Advisories/tree/master/CVE-2020-12608
CVE: CVE-2020-12679
Published: 2020-05-07
Description: A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATH_INFO to home.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/kampji/5ade2d15817650a725aa89fa2e6e4752; https://gist.github.com/kampji/5ade2d15817650a725aa89fa2e6e4752
CVE: CVE-2020-5743
Published: 2020-05-07
Description: Improper Control of Resource Identifiers in TCExam 14.2.2 allows a remote, authenticated attacker to access test metadata for which they don't have permission.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5744
Published: 2020-05-07
Description: Relative Path Traversal in TCExam 14.2.2 allows a remote, authenticated attacker to read the contents of arbitrary files on disk.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5745
Published: 2020-05-07
Description: Cross-site request forgery in TCExam 14.2.2 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVSS Score: 7.4 (HIGH)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5746
Published: 2020-05-07
Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted test.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5747
Published: 2020-05-07
Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted test.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5748
Published: 2020-05-07
Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5749
Published: 2020-05-07
Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted group.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5750
Published: 2020-05-07
Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks via the self-registration feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-5751
Published: 2020-05-07
Description: Insufficient output sanitization in TCExam 14.2.2 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by creating a crafted operator.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-31; https://www.tenable.com/security/research/tra-2020-31
CVE: CVE-2020-7646
Published: 2020-05-07
Description: curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/node-js-libs/curlrequest/blob/master/index.js#L239%2C; https://snyk.io/vuln/SNYK-JS-CURLREQUEST-568274; https://github.com/node-js-libs/curlrequest/blob/master/index.js#L239%2C
CVE: CVE-2019-19164
Published: 2020-05-07
Description: dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code infection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.dext5.com/page/support/notice_view.aspx?pSeq=23; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35344; http://www.dext5.com/page/support/notice_view.aspx?pSeq=23
CVE: CVE-2020-10971
Published: 2020-05-07
Description: An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution of the supplied command if there is an active session at the same time. The POST request itself is not validated to ensure it came from the active session. Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://github.com/Roni-Carta/nyra; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10971; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10971-Affected_Devices
CVE: CVE-2020-10972
Published: 2020-05-07
Description: An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No authentication is required in order to reach the page (a certain live_?.shtml page with the variable syspasswd). Affected Devices: Wavlink WN530HG4, Wavlink WN531G3, and Wavlink WN572HG3
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-522
References: https://github.com/Roni-Carta/nyra; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10972-affected_devices
CVE: CVE-2020-10973
Published: 2020-05-07
Description: An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform a decryption step, but all decryption information is readily available.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/Roni-Carta/nyra; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10973-affected_devices
CVE: CVE-2020-10974
Published: 2020-05-07
Description: An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext, including the administrator password. No authentication is required. Affected devices: Wavlink WN575A3, Wavlink WN579G3, Wavlink WN531A6, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, Wavlink WN572HG3, Wavlink WN575A4, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://github.com/Roni-Carta/nyra; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974; https://github.com/sudo-jtcsec/CVE/blob/master/CVE-2020-10974-affected_devices
CVE: CVE-2020-7803
Published: 2020-05-07
Description: IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.zoneplayer.co.kr/; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35346; http://www.zoneplayer.co.kr/
CVE: CVE-2020-7805
Published: 2020-05-07
Description: An issue was discovered on KT Slim egg IML500 (R7283, R8112, R8424) and IML520 (R8112, R8368, R8411) wifi device. This issue is a command injection allowing attackers to execute arbitrary OS commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: http://www.infomark.co.kr/bbs/board.php?bo_table=download&wr_id=57&sfl=wr_subject&stx=520&sop=and; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35362; http://www.infomark.co.kr/bbs/board.php?bo_table=download&wr_id=57&sfl=wr_subject&stx=520&sop=and
CVE: CVE-2020-11042
Published: 2020-05-07
Description: In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bounds read in update_read_icon_info. It allows reading a attacker-defined amount of client memory (32bit unsigned -> 4GB) to an intermediate buffer. This can be used to crash the client or store information for later retrieval. This has been patched in 2.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/6b2bc41935e53b0034fe5948aeeab4f32e80f30f; https://github.com/FreeRDP/FreeRDP/issues/6010; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jp6-5vf2-cx2q
CVE: CVE-2020-11044
Published: 2020-05-07
Description: In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_read_cache_bitmap_v3_order crashes the client application if corrupted data from a manipulated server is parsed. This has been patched in 2.0.0.
CVSS Score: 2.2 (LOW)
CWE: CWE-415, CWE-415, CWE-672
References: https://github.com/FreeRDP/FreeRDP/commit/67c2aa52b2ae0341d469071d1bc8aab91f8d2ed8; https://github.com/FreeRDP/FreeRDP/issues/6013; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqh-p732-6x2w
CVE: CVE-2020-11045
Published: 2020-05-07
Description: In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound read in in update_read_bitmap_data that allows client memory to be read to an image buffer. The result displayed on screen as colour.
CVSS Score: 2.2 (LOW)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/f8890a645c221823ac133dbf991f8a65ae50d637; https://github.com/FreeRDP/FreeRDP/issues/6005; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3x39-248q-f4q6
CVE: CVE-2020-11046
Published: 2020-05-07
Description: In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds seek in update_read_synchronize that could lead to a later out-of-bounds read.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/ed53cd148f43cbab905eaa0f5308c2bf3c48cc37; https://github.com/FreeRDP/FreeRDP/issues/6006; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hx48-wmmm-mr5q
CVE: CVE-2020-11047
Published: 2020-05-07
Description: In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read in autodetect_recv_bandwidth_measure_results. A malicious server can extract up to 8 bytes of client memory with a manipulated message by providing a short input and reading the measurement result data. This has been patched in 2.0.0.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://github.com/FreeRDP/FreeRDP/commit/f5e73cc7c9cd973b516a618da877c87b80950b65; https://github.com/FreeRDP/FreeRDP/issues/6009; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9fw6-m2q8-h5pw