deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-18703
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by CSRF. This affects D1500 before 1.0.0.25, D500 before 1.0.0.25, D6100 before 1.0.0.55, D7000 before 1.0.1.50, D7800 before 1.0.1.28, EX6100v2 before 1.0.1.60, EX6150v2 before 1.0.1.60, JNR1010v2 before 1.1.0.46, JR6150 before 1.0.1.16, JWNR2010v5 before 1.1.0.46, PR2000 before 1.0.0.18, R6020 before 1.0.0.26, R6050 before 1.0.1.16, R6080 before 1.0.0.26, R6100 before 1.0.1.20, R6220 before 1.1.0.60, R7500 before 1.0.0.118, R7500v2 before 1.0.3.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WN3000RPv3 before 1.0.2.50, WN3100RPv2 before 1.0.0.40, WNDR3700v5 before 1.1.0.48, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.46, WNR2000v5 before 1.0.0.62, WNR2020 before 1.1.0.46, and WNR2050 before 1.1.0.46.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000053199/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0736; https://kb.netgear.com/000053199/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0736
CVE: CVE-2017-18704
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by an attacker's ability to read arbitrary files. This affects D6220 before 1.0.0.32, D6400 before 1.0.0.60, D8500 before 1.0.3.29, R6250 before 1.0.4.16, R6300v2 before 1.0.4.18, R6400 before 1.01.32, R6400v2 before 1.0.2.44, R6700 before 1.0.1.36, R6900 before 1.0.1.34, R7000 before 1.0.9.14, R7000P before 1.3.0.8, R6900P before 1.3.0.8, R7100LG before 1.0.0.34, R7300DST before 1.0.0.56, R7900 before 1.0.1.26, R8000 before 1.0.4.4, R8500 before 1.0.2.106, R8300 before 1.0.2.106, and WNDR3400v3 before 1.0.1.16.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://kb.netgear.com/000053198/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2017-0590; https://kb.netgear.com/000053198/Security-Advisory-for-Arbitrary-File-Read-on-Some-Routers-and-Gateways-PSV-2017-0590
CVE: CVE-2017-18705
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.28, R6100 before 1.0.1.20, R7500 before 1.0.0.118, R7500v2 before 1.0.3.20, R7800 before 1.0.2.40, R9000 before 1.0.2.52, WNDR3700v4 before 1.0.2.88, WNDR4300 before 1.0.2.90, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, and WNR2000v5 before 1.0.0.62.
CVSS Score: 8.8 (HIGH)
References: https://kb.netgear.com/000053197/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2017-0526; https://kb.netgear.com/000053197/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Gateways-PSV-2017-0526
CVE: CVE-2018-21227
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, R6400v2 before 1.0.2.34, R6700 before 1.0.1.30, R6900 before 1.0.1.30, R6900P before 1.0.0.62, R7000 before 1.0.9.12, R7000P before 1.0.0.62, R7500v2 before 1.0.3.26, R7800 before 1.0.2.42, R9000 before 1.0.3.10, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74
References: https://kb.netgear.com/000055109/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2017-0737; https://kb.netgear.com/000055109/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-and-Gateways-PSV-2017-0737
CVE: CVE-2018-21228
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.34, EX6100v2 before 1.0.1.50, EX6150v2 before 1.0.1.50, EX6200v2 before 1.0.1.44, EX6400 before 1.0.1.60, EX7300 before 1.0.1.60, R6100 before 1.0.1.16, R7500 before 1.0.0.110, R7800 before 1.0.2.32, R9000 before 1.0.2.30, WN3000RPv3 before 1.0.2.50, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-74
References: https://kb.netgear.com/000055106/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0607; https://kb.netgear.com/000055106/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-Gateways-and-Extenders-PSV-2017-0607
CVE: CVE-2018-21229
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R7500v2 before 1.0.3.20, R7800 before 1.0.2.38, WN3000RPv3 before 1.0.2.50, WNDR4300v2 before 1.0.0.50, and WNDR4500v3 before 1.0.0.50.
CVSS Score: 6.5 (MEDIUM)
References: https://kb.netgear.com/000055105/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Extenders-PSV-2016-0124; https://kb.netgear.com/000055105/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-and-Extenders-PSV-2016-0124
CVE: CVE-2018-21230
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D1500 before 1.0.0.27, D500 before 1.0.0.27, D6100 before 1.0.0.57, D6220 before 1.0.0.40, D6400 before 1.0.0.74, D7000 before 1.0.1.60, D7800 before 1.0.1.34, D8500 before 1.0.3.39, DGN2200v4 before 1.0.0.94, DGN2200Bv4 before 1.0.0.94, EX2700 before 1.0.1.42, EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 before 1.0.0.24, EX6100 before 1.0.2.18, EX6120 before 1.0.0.32, EX6130 before 1.0.0.22, EX6150 before 1.0.0.34_1.0.70, EX6200 before 1.0.3.82_1.1.117, EX6400 before 1.0.1.78, EX7000 before 1.0.0.56, EX7300 before 1.0.1., JNR1010v2 before 1.1.0.42, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.42, PR2000 before 1.0.0.22, R6050 before 1.0.1.10, R6100 before 1.0.1.16, R6220 before 1.1.0.50, R6250 before 1.0.4.14, R6300v2 before 1.0.4.12, R6400v2 before 1.0.2.34, R6700 before 1.0.1.26, R6900 before 1.0.1.26, R6900P before 1.2.0.22, R7000 before 1.0.9.6, R7000P before 1.2.0.22, R7100LG before 1.0.0.40, R7300DST before 1.0.0.54, R7500 before 1.0.0.110, R7500v2 before 1.0.3.26, R7800 before 1.0.2.44, R7900 before 1.0.1.26, R8000 before 1.0.3.48, R8300 before 1.0.2.104, R8500 before 1.0.2.104, R9000 before 1.0.3.10, WN2000RPTv3 before 1.0.1.26, WN2500RPv2 before 1.0.1.46, WN3000RPv3 before 1.0.2.66, WN3100RPv2 before 1.0.0.56, WNDR3400v3 before 1.0.1.14, WNDR3700v4 before 1.0.2.96, WNDR3700v5 before 1.1.0.54, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.42, WNR2000v5 before 1.0.0.64, WNR2020 before 1.1.0.42, and WNR2050 before 1.1.0.42.
CVSS Score: 5.4 (MEDIUM)
References: https://kb.netgear.com/000055104/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-Gateways-and-Extenders-PSV-2016-0117; https://kb.netgear.com/000055104/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-Gateways-and-Extenders-PSV-2016-0117
CVE: CVE-2018-21231
Published: 2020-04-24
Description: Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D1500 before 1.0.0.27, D500 before 1.0.0.27, D6100 before 1.0.0.57, D6220 before 1.0.0.40, D6400 before 1.0.0.74, D7000 before 1.0.1.60, D7800 before 1.0.1.34, D8500 before 1.0.3.39, DGN2200v4 before 1.0.0.94, DGN2200Bv4 before 1.0.0.94, EX2700 before 1.0.1.42, EX3700 before 1.0.0.64, EX3800 before 1.0.0.64, EX6000 before 1.0.0.24, EX6100 before 1.0.2.18, EX6120 before 1.0.0.32, EX6130 before 1.0.0.22, EX6150 before 1.0.0.34_1.0.70, EX6200 before 1.0.3.82_1.1.117, EX6400 before 1.0.1.78, EX7000 before 1.0.0.56, EX7300 before 1.0.1.78, JNR1010v2 before 1.1.0.42, JR6150 before 1.0.1.10, JWNR2010v5 before 1.1.0.42, PR2000 before 1.0.0.22, R6050 before 1.0.1.10, R6100 before 1.0.1.16, R6220 before 1.1.0.50, R6250 before 1.0.4.14, R6300v2 before 1.0.4.12, R6400v2 before 1.0.2.34, R6700 before 1.0.1.26, R6900 before 1.0.1.26, R6900P before 1.2.0.22, R7000 before 1.0.9.6, R7000P before 1.2.0.22, R7100LG before 1.0.0.40, R7300DST before 1.0.0.54, R7500 before 1.0.0.110, R7500v2 before 1.0.3.26, R7800 before 1.0.2.44, R7900 before 1.0.1.26, R8000 before 1.0.3.48, R8300 before 1.0.2.104, R8500 before 1.0.2.104, R9000 before 1.0.3.10, WN2000RPTv3 before 1.0.1.26, WN2500RPv2 before 1.0.1.46, WN3000RPv3 before 1.0.2.66, WN3100RPv2 before 1.0.0.56, WNDR3400v3 before 1.0.1.14, WNDR3700v4 before 1.0.2.96, WNDR3700v5 before 1.1.0.54, WNDR4300 before 1.0.2.98, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, WNR1000v4 before 1.1.0.42, WNR2000v5 before 1.0.0.64, WNR2020 before 1.1.0.42, and WNR2050 before 1.1.0.42.
CVSS Score: 5.4 (MEDIUM)
References: https://kb.netgear.com/000055103/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-Gateways-and-Extenders-PSV-2016-0102; https://kb.netgear.com/000055103/Security-Advisory-for-Security-Misconfiguration-on-Some-Routers-Gateways-and-Extenders-PSV-2016-0102
CVE: CVE-2019-4750
Published: 2020-04-24
Description: IBM Cloud App Management 2019.3.0 and 2019.4.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 173310.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/173310; https://www.ibm.com/support/pages/node/6190551; https://exchange.xforce.ibmcloud.com/vulnerabilities/173310
CVE: CVE-2019-4751
Published: 2020-04-24
Description: IBM Cloud App Management 2019.3.0 and 2019.4.0 reveals a stack trace on certain API requests which can allow an attacker further information about the implementation of the offering. IBM X-Force ID: 173311.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/173311; https://www.ibm.com/support/pages/node/6190557; https://exchange.xforce.ibmcloud.com/vulnerabilities/173311
CVE: CVE-2020-4267
Published: 2020-04-24
Description: IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD could allow an authenticated user cause a denial of service due to a memory leak. IBM X-Force ID: 175840.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-401
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175840; https://www.ibm.com/support/pages/node/6195384; https://exchange.xforce.ibmcloud.com/vulnerabilities/175840
CVE: CVE-2020-6819
Published: 2020-04-24
Description: Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1620818; https://usn.ubuntu.com/4335-1/; https://www.mozilla.org/security/advisories/mfsa2020-11/
CVE: CVE-2020-6820
Published: 2020-04-24
Description: Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1626728; https://usn.ubuntu.com/4335-1/; https://www.mozilla.org/security/advisories/mfsa2020-11/
CVE: CVE-2020-6821
Published: 2020-04-24
Description: When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code> method, the specification requires the returned values be zero. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1625404; https://usn.ubuntu.com/4335-1/; https://www.mozilla.org/security/advisories/mfsa2020-12/
CVE: CVE-2020-6822
Published: 2020-04-24
Description: On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1544181; https://usn.ubuntu.com/4335-1/; https://www.mozilla.org/security/advisories/mfsa2020-12/
CVE: CVE-2020-6823
Published: 2020-04-24
Description: A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox < 75.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1614919; https://www.mozilla.org/security/advisories/mfsa2020-12/; https://bugzilla.mozilla.org/show_bug.cgi?id=1614919
CVE: CVE-2020-6824
Published: 2020-04-24
Description: Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. This vulnerability affects Firefox < 75.
CVSS Score: 2.8 (LOW)
CWE: CWE-384
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1621853; https://www.mozilla.org/security/advisories/mfsa2020-12/; https://bugzilla.mozilla.org/show_bug.cgi?id=1621853
CVE: CVE-2020-6825
Published: 2020-04-24
Description: Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1572541%2C1620193%2C1620203; https://usn.ubuntu.com/4335-1/; https://www.mozilla.org/security/advisories/mfsa2020-12/
CVE: CVE-2020-6826
Published: 2020-04-24
Description: Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 75.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1613009%2C1613195%2C1616734%2C1617488%2C1619229%2C1620719%2C1624897; https://www.mozilla.org/security/advisories/mfsa2020-12/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1613009%2C1613195%2C1616734%2C1617488%2C1619229%2C1620719%2C1624897
CVE: CVE-2020-6827
Published: 2020-04-24
Description: When following a link that opened an intent://-schemed URL, causing a custom tab to be opened, Firefox for Android could be tricked into displaying the incorrect URI. <br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1622278; https://www.mozilla.org/security/advisories/mfsa2020-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1622278
CVE: CVE-2020-6828
Published: 2020-04-24
Description: A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference values. Control of arbitrary preferences can lead to sufficient compromise such that it is generally equivalent to arbitrary code execution.<br> *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1617928; https://www.mozilla.org/security/advisories/mfsa2020-13/; https://bugzilla.mozilla.org/show_bug.cgi?id=1617928
CVE: CVE-2020-7131
Published: 2020-04-24
Description: This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products. All J/H-series NonStop systems have a security vulnerability associated with an open UDP port 17185 on the Maintenance LAN which could result in information disclosure, denial-of-service attacks or local memory corruption against the affected system and a complete control of the system may also be possible. This vulnerability exists only if one gains access to the Maintenance LAN to which Blade Maintenance Entity, Integrated Maintenance Entity or Maintenance Entity product is connected. **Workaround:** Block the UDP port 17185(In the Maintenance LAN Network Switch/Firewall). Fix: Install following SPRs, which are already available: * T1805A01^AAI (Integrated Maintenance Entity) * T4805A01^AAZ (Blade Maintenance Entity). These SPRs are also usable with the following RVUs: * J06.19.00 ? J06.23.01. No fix planned for the following RVUs: J06.04.00 ? J06.18.01. No fix planned for H-Series NonStop systems. No fix planned for the product T2805 (Maintenance Entity).
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-787
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03996en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03996en_us
CVE: CVE-2020-1741
Published: 2020-04-24
Description: A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-185, CWE-697
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1741; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1741
CVE: CVE-2020-7133
Published: 2020-04-24
Description: A unauthorized remote access vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03947en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03947en_us
CVE: CVE-2020-7134
Published: 2020-04-24
Description: A remote access to sensitive data vulnerability was discovered in HPE IOT + GCP version(s): 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.
CVSS Score: 6.5 (MEDIUM)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03947en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03947en_us
CVE: CVE-2020-11013
Published: 2020-04-24
Description: Their is an information disclosure vulnerability in Helm from version 3.1.0 and before version 3.2.0. `lookup` is a Helm template function introduced in Helm v3. It is able to lookup resources in the cluster to check for the existence of specific resources and get details about them. This can be used as part of the process to render templates. The documented behavior of `helm template` states that it does not attach to a remote cluster. However, a the recently added `lookup` template function circumvents this restriction and connects to the cluster even during `helm template` and `helm install|update|delete|rollback --dry-run`. The user is not notified of this behavior. Running `helm template` should not make calls to a cluster. This is different from `install`, which is presumed to have access to a cluster in order to load resources into Kubernetes. Helm 2 is unaffected by this vulnerability. A malicious chart author could inject a `lookup` into a chart that, when rendered through `helm template`, performs unannounced lookups against the cluster a user&#39;s `KUBECONFIG` file points to. This information can then be disclosed via the output of `helm template`. This issue has been fixed in Helm 3.2.0
CVSS Score: 8.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://github.com/helm/helm/releases/tag/v3.2.0; https://github.com/helm/helm/security/advisories/GHSA-q8q8-93cv-v6h8; https://github.com/helm/helm/releases/tag/v3.2.0
CVE: CVE-2020-11004
Published: 2020-04-24
Description: SQL Injection was discovered in Admidio before version 3.3.13. The main cookie parameter is concatenated into a SQL query without any input validation/sanitization, thus an attacker without logging in, can send a GET request with arbitrary SQL queries appended to the cookie parameter and execute SQL queries. The vulnerability impacts the confidentiality of the system. This has been patched in version 3.3.13.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/Admidio/admidio/commit/ea5d6f114b151ed11ec0ad7cb47bd729e77a874a; https://github.com/Admidio/admidio/issues/908; https://github.com/Admidio/admidio/security/advisories/GHSA-qh57-rcff-gx54
CVE: CVE-2020-12245
Published: 2020-04-24
Description: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html
CVE: CVE-2020-12070
Published: 2020-04-24
Description: The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every ajax search request via the sql field to includes/class-aws-search.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/1.99/includes/class-aws-search.php#L222; https://plugins.trac.wordpress.org/browser/advanced-woo-search/tags/2.00/includes/class-aws-search.php?rev=2290090#L219; https://wordpress.org/plugins/advanced-woo-search/#developers
CVE: CVE-2020-6212
Published: 2020-04-24
Description: Egypt localized withholding tax reports Clearing of Liabilities and Remittance Statement and Summary in SAP ERP (versions 618, 730, EAPPLGLO 607) and S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user, allowing reading or modification of some tax reports, due to Missing Authorization Check.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2864966; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202; https://launchpad.support.sap.com/#/notes/2864966
CVE: CVE-2020-6213
Published: 2020-04-24
Description: SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL parameters as it does not sufficiently encode user controlled inputs.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2872752; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202; https://launchpad.support.sap.com/#/notes/2872752
CVE: CVE-2020-12254
Published: 2020-04-26
Description: Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://web.archive.org/web/[PII_REDACTED]3852/https://support.avira.com/hc/en-us/articles/[PII_REDACTED]98-Avira-Antivirus-for-Windows; https://support.avira.com/hc/en-us/articles/[PII_REDACTED]98-Avira-Antivirus-for-Windows; http://web.archive.org/web/[PII_REDACTED]3852/https://support.avira.com/hc/en-us/articles/[PII_REDACTED]98-Avira-Antivirus-for-Windows