deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-9521
Published: 2020-03-26
Description: An SQL injection vulnerability was discovered in Micro Focus Service Manager Automation (SMA), affecting versions 2019.08, 2019.05, 2019.02, 2018.08, 2018.05, 2018.02. The vulnerability could allow for the improper neutralization of special elements in SQL commands and may lead to the product being vulnerable to SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://softwaresupport.softwaregrp.com/doc/KM03630615; https://softwaresupport.softwaregrp.com/doc/KM03630615
CVE: CVE-2020-10823
Published: 2020-03-26
Description: A stack-based buffer overflow in /cgi-bin/activate.cgi through var parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 1 of 3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://slashd.ga/2020/03/draytek-vulnerabilities/; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/; https://slashd.ga/2020/03/draytek-vulnerabilities/
CVE: CVE-2020-10824
Published: 2020-03-26
Description: A stack-based buffer overflow in /cgi-bin/activate.cgi through ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 2 of 3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://slashd.ga/2020/03/draytek-vulnerabilities/; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/; https://slashd.ga/2020/03/draytek-vulnerabilities/
CVE: CVE-2020-10825
Published: 2020-03-26
Description: A stack-based buffer overflow in /cgi-bin/activate.cgi while base64 decoding ticket parameter on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request (issue 3 of 3).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://slashd.ga/2020/03/draytek-vulnerabilities/; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/; https://slashd.ga/2020/03/draytek-vulnerabilities/
CVE: CVE-2020-10826
Published: 2020-03-26
Description: /cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://slashd.ga/2020/03/draytek-vulnerabilities/; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/; https://slashd.ga/2020/03/draytek-vulnerabilities/
CVE: CVE-2020-10827
Published: 2020-03-26
Description: A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://slashd.ga/2020/03/draytek-vulnerabilities/; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/; https://slashd.ga/2020/03/draytek-vulnerabilities/
CVE: CVE-2020-10828
Published: 2020-03-26
Description: A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to achieve code execution via a remote HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://slashd.ga/2020/03/draytek-vulnerabilities/; https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-stack-based-buffer-overflow-vulnerability/; https://slashd.ga/2020/03/draytek-vulnerabilities/
CVE: CVE-2020-9467
Published: 2020-03-26
Description: Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/159191/Piwigo-2.10.1-Cross-Site-Scripting.html; https://github.com/Piwigo/Piwigo/issues/1168; http://packetstormsecurity.com/files/159191/Piwigo-2.10.1-Cross-Site-Scripting.html
CVE: CVE-2020-9468
Published: 2020-03-26
Description: The Community plugin 2.9.e-beta for Piwigo allows users to set image information on images in albums for which they do not have permission, by manipulating the image_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://github.com/plegall/Piwigo-community/issues/49; https://piwigo.org/ext/extension_view.php?eid=303; https://github.com/plegall/Piwigo-community/issues/49
CVE: CVE-2020-10990
Published: 2020-03-27
Description: An XXE issue exists in Accenture Mercury before 1.12.28 because of the platformlambda/core/serializers/SimpleXmlParser.java component.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/Accenture/mercury/commit/f647a01347485d2afe3a0b735eab3d0121d61f46; https://github.com/Accenture/mercury/issues/13; https://github.com/Accenture/mercury/commit/f647a01347485d2afe3a0b735eab3d0121d61f46
CVE: CVE-2020-10991
Published: 2020-03-27
Description: Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/mulesoft/apikit/issues/547; https://github.com/mulesoft/apikit/issues/547
CVE: CVE-2020-10992
Published: 2020-03-27
Description: Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/azkaban/azkaban/issues/2478; https://github.com/azkaban/azkaban/issues/2478
CVE: CVE-2020-10993
Published: 2020-03-27
Description: Osmand through 2.0.0 allow XXE because of binary/BinaryMapIndexReader.java.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://github.com/osmandapp/Osmand/issues/8711; https://github.com/osmandapp/Osmand/issues/8711
CVE: CVE-2020-3920
Published: 2020-03-27
Description: UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://www.twcert.org.tw/tw/cp-132-3452-937d6-1.html; https://www.twcert.org.tw/tw/cp-132-3452-937d6-1.html
CVE: CVE-2020-3921
Published: 2020-03-27
Description: UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.
CVSS Score: 8.6 (HIGH)
CWE: CWE-312
References: https://www.twcert.org.tw/tw/cp-132-3453-442a5-1.html; https://www.twcert.org.tw/tw/cp-132-3453-442a5-1.html
CVE: CVE-2020-3936
Published: 2020-03-27
Description: UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://www.twcert.org.tw/tw/cp-132-3451-7d9f0-1.html; https://www.twcert.org.tw/tw/cp-132-3451-7d9f0-1.html
CVE: CVE-2020-10508
Published: 2020-03-27
Description: Sunnet eHRD, a human training and development management system, improperly stores system files. Attackers can use a specific URL and capture confidential information.
CVSS Score: 7.5 (HIGH)
References: https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71; https://www.twcert.org.tw/tw/cp-132-3448-76a35-1.html; https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71
CVE: CVE-2020-10509
Published: 2020-03-27
Description: Sunnet eHRD, a human training and development management system, contains vulnerability of Cross-Site Scripting (XSS), attackers can inject arbitrary command into the system and launch XSS attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71; https://www.twcert.org.tw/tw/cp-132-3449-c87d8-1.html; https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71
CVE: CVE-2020-10510
Published: 2020-03-27
Description: Sunnet eHRD, a human training and development management system, contains a vulnerability of Broken Access Control. After login, attackers can use a specific URL, access unauthorized functionality and data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-863
References: https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71; https://www.twcert.org.tw/tw/cp-132-3450-69466-1.html; https://www.chtsecurity.com/news/30772cf1-2e7e-4afe-9282-b5a196b22e71
CVE: CVE-2020-1769
Published: 2020-03-27
Description: In the login screens (in agent and customer interface), Username and Password fields use autocomplete, which might be considered as security issue. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
CVSS Score: 3.5 (LOW)
CWE: CWE-16
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2020-1770
Published: 2020-03-27
Description: Support bundle generated files could contain sensitive information that might be unwanted to be disclosed. This issue affects: ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
CVSS Score: 2.4 (LOW)
CWE: CWE-201, CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2020-1771
Published: 2020-03-27
Description: Attacker is able craft an article with a link to the customer address book with malicious content (JavaScript). When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: ((OTRS)) Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2020-1772
Published: 2020-03-27
Description: It's possible to craft Lost Password requests with wildcards in the Token value, which allows attacker to retrieve valid Token(s), generated by users which already requested new passwords. This issue affects: ((OTRS)) Community Edition 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS: 7.0.15 and prior versions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-155
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2020-1773
Published: 2020-03-27
Description: An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS; 7.0.15 and prior versions.
CVSS Score: 7.3 (HIGH)
CWE: CWE-331, CWE-331
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2020-10607
Published: 2020-03-27
Description: In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-20-086-01; https://www.us-cert.gov/ics/advisories/icsa-20-086-01
CVE: CVE-2020-7918
Published: 2020-03-27
Description: An insecure direct object reference in webmail in totemo totemomail 7.0.0 allows an authenticated remote user to read and modify mail folder names of other users via enumeration.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://objectif-securite.ch/2020/03/20/IDOR-totemo-mail-folder.html; https://www.totemo.com/en/solutions/email-encryption; https://objectif-securite.ch/2020/03/20/IDOR-totemo-mail-folder.html
CVE: CVE-2015-5684
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://support.lenovo.com/us/en/product_security/lse_bios_notebook; https://support.lenovo.com/us/en/product_security/lse_bios_notebook
CVE: CVE-2015-7333
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type INF and INF_BY_COMPATIBLE_ID command types could allow a user to execute arbitrary code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.lenovo.com/us/en/product_security/lsu_privilege; https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE: CVE-2015-7334
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.lenovo.com/us/en/product_security/lsu_privilege; https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE: CVE-2015-7335
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://support.lenovo.com/us/en/product_security/lsu_privilege; https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE: CVE-2015-7336
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://support.lenovo.com/us/en/product_security/lsu_privilege; https://support.lenovo.com/us/en/product_security/lsu_privilege
CVE: CVE-2015-8534
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.lenovo.com/us/en/product_security/len_4326; https://support.lenovo.com/us/en/product_security/len_4326
CVE: CVE-2015-8535
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://support.lenovo.com/us/en/product_security/len_4326; https://support.lenovo.com/us/en/product_security/len_4326
CVE: CVE-2015-8536
Published: 2020-03-27
Description: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow cross-site request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.lenovo.com/us/en/product_security/len_4326; https://support.lenovo.com/us/en/product_security/len_4326
CVE: CVE-2020-5857
Published: 2020-03-27
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.2, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, undisclosed HTTP behavior may lead to a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K70275209; https://support.f5.com/csp/article/K70275209
CVE: CVE-2020-5858
Published: 2020-03-27
Description: On BIG-IP 15.0.0-15.0.1.2, 14.1.0-14.1.2.2, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, users with non-administrator roles (for example, Guest or Resource Administrator) with tmsh shell access can execute arbitrary commands with elevated privilege via a crafted tmsh command.
CVSS Score: 7.8 (HIGH)
References: https://support.f5.com/csp/article/K36814487; https://support.f5.com/csp/article/K36814487
CVE: CVE-2020-5859
Published: 2020-03-27
Description: On BIG-IP 15.1.0.1, specially formatted HTTP/3 messages may cause TMM to produce a core file.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K61367237; https://support.f5.com/csp/article/K61367237
CVE: CVE-2020-5860
Published: 2020-03-27
Description: On BIG-IP 15.0.0-15.1.0.2, 14.1.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5.1, and 11.5.2-11.6.5.1 and BIG-IQ 7.0.0, 6.0.0-6.1.0, and 5.2.0-5.4.0, in a High Availability (HA) network failover in Device Service Cluster (DSC), the failover service does not require a strong form of authentication and HA network failover traffic is not encrypted by Transport Layer Security (TLS).
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-319
References: https://support.f5.com/csp/article/K67472032; https://support.f5.com/csp/article/K67472032
CVE: CVE-2020-5861
Published: 2020-03-27
Description: On BIG-IP 12.1.0-12.1.5, the TMM process may produce a core file in some cases when Ram Cache incorrectly optimizes stored data resulting in memory errors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://support.f5.com/csp/article/K22113131; https://support.f5.com/csp/article/K22113131
CVE: CVE-2020-5862
Published: 2020-03-27
Description: On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.2, under certain conditions, TMM may crash or stop processing new traffic with the DPDK/ENA driver on AWS systems while sending traffic. This issue does not affect any other platforms, hardware or virtual, or any other cloud provider since the affected driver is specific to AWS.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K01054113; https://support.f5.com/csp/article/K01054113
CVE: CVE-2020-5863
Published: 2020-03-27
Description: In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.
CVSS Score: 8.6 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.f5.com/csp/article/K14631834; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-8551
Published: 2020-03-27
Description: The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://github.com/kubernetes/kubernetes/issues/89377; https://groups.google.com/forum/#%21topic/kubernetes-security-announce/2UOlsba2g0s; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
CVE: CVE-2020-8552
Published: 2020-03-27
Description: The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-789, CWE-770
References: https://github.com/kubernetes/kubernetes/issues/89378; https://groups.google.com/forum/#%21topic/kubernetes-security-announce/2UOlsba2g0s; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
CVE: CVE-2020-10817
Published: 2020-03-27
Description: The custom-searchable-data-entry-system (aka Custom Searchable Data Entry System) plugin through 1.7.1 for WordPress allows SQL Injection. NOTE: this product is discontinued.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://avveng.com/cve.html; https://plugins.trac.wordpress.org/log/custom-searchable-data-entry-system/; http://avveng.com/cve.html
CVE: CVE-2020-10952
Published: 2020-03-27
Description: GitLab EE/CE 8.11 through 12.9.1 allows blocked users to pull/push docker images.
CVSS Score: 6.5 (MEDIUM)
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10953
Published: 2020-03-27
Description: In GitLab EE 11.7 through 12.9, the NPM feature is vulnerable to a path traversal issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10954
Published: 2020-03-27
Description: GitLab through 12.9 is affected by a potential DoS in repository archive download.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10955
Published: 2020-03-27
Description: GitLab EE/CE 11.1 through 12.9 is vulnerable to parameter tampering on an upload feature that allows an unauthorized user to read content available under specific folders.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://www.debian.org/security/2020/dsa-4691
CVE: CVE-2020-10956
Published: 2020-03-27
Description: GitLab 8.10 and later through 12.9 is vulnerable to an SSRF in a project import note feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10939
Published: 2020-03-27
Description: Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://cert.vde.com/en-us/advisories/vde-2020-012; https://cert.vde.com/en-us/advisories/vde-2020-012