deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-10578
Published: 2020-03-14
Description: An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1.
CVSS Score: 7.5 (HIGH)
References: https://blog.csdn.net/yalecaltech/article/details/104789626; https://blog.csdn.net/yalecaltech/article/details/104789626
CVE: CVE-2020-10587
Published: 2020-03-14
Description: antiX and MX Linux allow local users to achieve root access via "persist-config --command /bin/sh" because of the Sudo configuration.
CVSS Score: 7.8 (HIGH)
References: https://gist.github.com/bash-c/d2055b5047e56a0b49c95b461347c619#file-antix-exp-sh; https://gist.github.com/bash-c/d2055b5047e56a0b49c95b461347c619#file-mx-exp-sh; https://gist.github.com/bash-c/d2055b5047e56a0b49c95b461347c619#file-antix-exp-sh
CVE: CVE-2019-15608
Published: 2020-03-15
Description: The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-840, CWE-367
References: https://github.com/yarnpkg/yarn/blob/master/CHANGELOG.md#1190; https://github.com/yarnpkg/yarn/commit/0474b8c66a8ea298f5e4dedc67b2de464297ad1c; https://hackerone.com/reports/703138
CVE: CVE-2020-8141
Published: 2020-03-15
Description: The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://hackerone.com/reports/390929; https://hackerone.com/reports/390929
CVE: CVE-2020-10588
Published: 2020-03-15
Description: v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/add.sh and /etc/v2rayL/remove.sh are owned by a low-privileged user but execute as root via Sudo.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://gist.github.com/bash-c/6ac238e8b15e60c9105e8cb6b42ec43c#file-v2rayl-lpe-exp1-sh; https://gist.github.com/bash-c/6ac238e8b15e60c9105e8cb6b42ec43c#file-v2rayl-lpe-exp1-sh
CVE: CVE-2020-10589
Published: 2020-03-15
Description: v2rayL 2.1.3 allows local users to achieve root access because /etc/v2rayL/config.json is owned by a low-privileged user but contains commands that are executed as root, after v2rayL.service is restarted via Sudo.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://gist.github.com/bash-c/6ac238e8b15e60c9105e8cb6b42ec43c#file-v2rayl-lpe-exp2-sh; https://gist.github.com/bash-c/6ac238e8b15e60c9105e8cb6b42ec43c#file-v2rayl-lpe-exp2-sh
CVE: CVE-2020-10591
Published: 2020-03-15
Description: An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.
CVSS Score: 7.5 (HIGH)
References: https://github.com/walmartlabs/concord/compare/1.43.0...1.44.0; https://github.com/walmartlabs/concord/issues/22; https://github.com/walmartlabs/concord/compare/1.43.0...1.44.0
CVE: CVE-2019-2058
Published: 2020-03-15
Description: In libAACdec, there is a possible out of bounds read. This could lead to remote information disclosure, with no additional execution privileges needed. User interaction is needed for exploitation.Product: Android Versions: Android-10 Android ID: A-136089102
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/android-10
CVE: CVE-2019-2088
Published: 2020-03-15
Description: In StatsService, there is a possible out of bounds read. This could lead to local information disclosure if UBSAN were not enabled, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-143895055
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/android-10
CVE: CVE-2019-2089
Published: 2020-03-15
Description: In app uninstallation, there is a possible set of permissions that may not be removed from a shared app ID. This could lead to a local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-10 Android ID: A-116608833
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/android-10
CVE: CVE-2019-2216
Published: 2020-03-15
Description: In overlay notifications, there is a possible hidden notification due to improper input validation. This could lead to a local escalation of privilege because the user is not notified of an overlaying app, with User execution privileges needed. User interaction is needed for exploitation.Product: Android Versions: Android-10 Android ID: A-38390530
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/android-10
CVE: CVE-2019-9473
Published: 2020-03-15
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-115363533
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/android-10
CVE: CVE-2019-9474
Published: 2020-03-15
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-79996267
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/android-10
CVE: CVE-2020-0086
Published: 2020-03-15
Description: In readCString of Parcel.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to arbitrary code execution if IntSan were not enabled, which it is by default. No additional execution privileges are required. User interaction is not needed for exploitation. Product: Android Versions: Android-10 Android ID: A-131859347
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/android-10
CVE: CVE-2020-0088
Published: 2020-03-15
Description: In parseTrackFragmentRun of MPEG4Extractor.cpp, there is possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-124389881
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://source.android.com/security/bulletin/pixel/2020-06-01; https://source.android.com/security/bulletin/android-10; https://source.android.com/security/bulletin/pixel/2020-06-01
CVE: CVE-2020-10594
Published: 2020-03-15
Description: An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: https://github.com/Styria-Digital/django-rest-framework-jwt/issues/36; https://github.com/jpadilla/django-rest-framework-jwt/issues/484; https://pypi.org/project/drf-jwt/1.15.1/#history
CVE: CVE-2020-7601
Published: 2020-03-15
Description: gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-GULPSCSSLINT-560114; https://snyk.io/vuln/SNYK-JS-GULPSCSSLINT-560114
CVE: CVE-2020-7602
Published: 2020-03-15
Description: node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is used to construct the argument of function "execSync()", which can be controlled by users without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-NODEPROMPTHERE-560115; https://snyk.io/vuln/SNYK-JS-NODEPROMPTHERE-560115
CVE: CVE-2020-7603
Published: 2020-03-15
Description: closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123; https://snyk.io/vuln/SNYK-JS-CLOSURECOMPILERSTREAM-560123
CVE: CVE-2020-7604
Published: 2020-03-15
Description: pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this vulnerability, an attacker will need to create a new file with the same name as the attack command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-PULVERIZR-560122; https://snyk.io/vuln/SNYK-JS-PULVERIZR-560122
CVE: CVE-2020-7605
Published: 2020-03-15
Description: gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-GULPTAPE-560124; https://snyk.io/vuln/SNYK-JS-GULPTAPE-560124
CVE: CVE-2020-7606
Published: 2020-03-15
Description: docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' uses the variable 'serviceName' which can be controlled by users without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125; https://snyk.io/vuln/SNYK-JS-DOCKERCOMPOSEREMOTEAPI-560125
CVE: CVE-2020-7607
Published: 2020-03-15
Description: gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://snyk.io/vuln/SNYK-JS-GULPSTYLEDOCCO-560126; https://snyk.io/vuln/SNYK-JS-GULPSTYLEDOCCO-560126
CVE: CVE-2020-9287
Published: 2020-03-15
Description: An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which FortiClientEMSOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://fortiguard.com/psirt/FG-IR-19-060; https://fortiguard.com/psirt/FG-IR-19-060
CVE: CVE-2020-9290
Published: 2020-03-15
Description: An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in which FortiClientOnlineInstaller.exe and FortiClientVPNOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious Filter Library DLL files in that directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://fortiguard.com/psirt/FG-IR-19-060; https://fortiguard.com/psirt/FG-IR-19-060
CVE: CVE-2019-15708
Published: 2020-03-15
Description: A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78
References: https://fortiguard.com/psirt/FG-IR-19-209; https://fortiguard.com/psirt/FG-IR-19-209
CVE: CVE-2019-17654
Published: 2020-03-15
Description: An Insufficient Verification of Data Authenticity vulnerability in FortiManager 6.2.1, 6.2.0, 6.0.6 and below may allow an unauthenticated attacker to perform a Cross-Site WebSocket Hijacking (CSWSH) attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://fortiguard.com/psirt/FG-IR-19-191; https://fortiguard.com/psirt/FG-IR-19-191
CVE: CVE-2019-6696
Published: 2020-03-15
Description: An improper input validation vulnerability in FortiOS 6.2.1, 6.2.0, 6.0.8 and below until 5.4.0 under admin webUI may allow an attacker to perform an URL redirect attack via a specifically crafted request to the admin initial password change webpage.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-601
References: https://fortiguard.com/psirt/FG-IR-19-179; https://fortiguard.com/psirt/FG-IR-19-179
CVE: CVE-2020-5542
Published: 2020-03-16
Description: Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to stop the network functions or execute malware via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://jvn.jp/en/vu/JVNVU92370624/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf; https://jvn.jp/en/vu/JVNVU92370624/index.html
CVE: CVE-2020-5543
Published: 2020-03-16
Description: TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allows remote attackers to stop the network functions or execute malware via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-384
References: https://jvn.jp/en/vu/JVNVU92370624/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf; https://jvn.jp/en/vu/JVNVU92370624/index.html
CVE: CVE-2020-5544
Published: 2020-03-16
Description: Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to stop the network functions or execute malware via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://jvn.jp/en/vu/JVNVU92370624/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf; https://jvn.jp/en/vu/JVNVU92370624/index.html
CVE: CVE-2020-5545
Published: 2020-03-16
Description: TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to bypass access restriction and to stop the network functions or execute malware via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
References: https://jvn.jp/en/vu/JVNVU92370624/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf; https://jvn.jp/en/vu/JVNVU92370624/index.html
CVE: CVE-2020-5546
Published: 2020-03-16
Description: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functions or execute malware via a specially crafted packet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-88
References: https://jvn.jp/en/vu/JVNVU92370624/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf; https://jvn.jp/en/vu/JVNVU92370624/index.html
CVE: CVE-2020-5547
Published: 2020-03-16
Description: Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to stop the network functions or execute malware via a specially crafted packet.
CVSS Score: 9.8 (CRITICAL)
References: https://jvn.jp/en/vu/JVNVU92370624/index.html; https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf; https://jvn.jp/en/vu/JVNVU92370624/index.html
CVE: CVE-2020-9519
Published: 2020-03-16
Description: HTTP methods reveled in Web services vulnerability in Micro Focus Service manager (server), affecting versions 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62, 9.63. The vulnerability could be exploited to allow exposure of configuration data.
CVSS Score: 5.3 (MEDIUM)
References: https://softwaresupport.softwaregrp.com/doc/KM03607789; https://softwaresupport.softwaregrp.com/doc/KM03607789
CVE: CVE-2019-10091
Published: 2020-03-16
Description: When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://lists.apache.org/thread.html/r3342077ac[PII_REDACTED]366be86e545d0c08753cca8fd2663867fe200%40%3Cdev.geode.apache.org%3E; https://lists.apache.org/thread.html/r3342077ac[PII_REDACTED]366be86e545d0c08753cca8fd2663867fe200%40%3Cdev.geode.apache.org%3E
CVE: CVE-2020-9518
Published: 2020-03-16
Description: Login filter can access configuration files vulnerability in Micro Focus Service Manager (Web Tier), affecting versions 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. The vulnerability could be exploited to allow unauthorized access to configuration data.
CVSS Score: 5.3 (MEDIUM)
References: https://softwaresupport.softwaregrp.com/doc/KM03607792; https://softwaresupport.softwaregrp.com/doc/KM03607792
CVE: CVE-2018-10125
Published: 2020-03-16
Description: Contao before 4.5.7 has XSS in the system log.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log.html; https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log.html
CVE: CVE-2018-13060
Published: 2020-03-16
Description: Easy!Appointments 1.3.0 has a Guessable CAPTCHA issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://sysdream.com/news/lab/; https://sysdream.com/news/lab/2019-10-25-cve-2018-13060-easy-appointments-captcha-bypass/; https://sysdream.com/news/lab/
CVE: CVE-2018-13063
Published: 2020-03-16
Description: Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://sysdream.com/news/lab/; https://sysdream.com/news/lab/2019-10-25-cve-2018-13063-easy-appointments-multiple-confidential-information-leakage/; https://sysdream.com/news/lab/
CVE: CVE-2019-14512
Published: 2020-03-16
Description: LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/LimeSurvey/LimeSurvey/commit/0b7391dff91b326284ca3fc5188b768b5d522d88; https://github.com/LimeSurvey/LimeSurvey/commit/f2566f6978a77e3f0870079c45cda1c065a58a73; https://www.limesurvey.org/
CVE: CVE-2019-14887
Published: 2020-03-16
Description: A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-757
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887; https://issues.redhat.com/browse/JBEAP-17965; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-19208
Published: 2020-03-16
Description: Codiad Web IDE through 2.8.4 allows PHP Code injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://packetstormsecurity.com/files/162753/Codiad-2.8.4-Remote-Code-Execution.html; https://github.com/Codiad/Codiad/commits/master; https://github.com/Hacker5preme/Exploits/tree/main/CVE-2019-19208-Exploit
CVE: CVE-2019-19209
Published: 2020-03-16
Description: Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://herolab.usd.de/en/security-advisories/; https://herolab.usd.de/security-advisories/usd-2019-0051/; https://www.dolibarr.org/forum/dolibarr-changelogs
CVE: CVE-2019-19210
Published: 2020-03-16
Description: Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/en/security-advisories/; https://herolab.usd.de/security-advisories/usd-2019-0052/; https://www.dolibarr.org/forum/dolibarr-changelogs
CVE: CVE-2019-19211
Published: 2020-03-16
Description: Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/en/security-advisories/; https://herolab.usd.de/en/security-advisories/usd-2019-0053/; https://www.dolibarr.org/forum/dolibarr-changelogs
CVE: CVE-2020-10557
Published: 2020-03-16
Description: An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file manager page contains an arbitrary file upload vulnerability via upload.php. The extension .php7 bypasses file upload restrictions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://github.com/cinzinga/CVEs/tree/master/CVE-2020-10557; https://sourceforge.net/projects/acontent/; https://github.com/cinzinga/CVEs/tree/master/CVE-2020-10557
CVE: CVE-2020-1753
Published: 2020-03-16
Description: A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200, CWE-214, CWE-532, CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1753; https://github.com/ansible-collections/kubernetes/pull/51; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/
CVE: CVE-2019-19135
Published: 2020-03-16
Description: In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network.
CVSS Score: 7.4 (HIGH)
CWE: CWE-330
References: https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf; https://opcfoundation.org/security-bulletins/; https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf