deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5618
Published: 2020-04-29
Description: A-PDF WAV to MP3 version 1.0.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.rapid7.com/db/modules/exploit/windows/fileformat/a_pdf_wav_to_mp3; https://www.rapid7.com/db/modules/exploit/windows/fileformat/a_pdf_wav_to_mp3
CVE: CVE-2019-5619
Published: 2020-04-29
Description: AASync.com AASync version 2.2.1.0 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.rapid7.com/db/modules/exploit/windows/ftp/aasync_list_reply; https://www.rapid7.com/db/modules/exploit/windows/ftp/aasync_list_reply
CVE: CVE-2019-5620
Published: 2020-04-29
Description: ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.rapid7.com/db/modules/exploit/windows/scada/abb_wserver_exec; https://www.rapid7.com/db/modules/exploit/windows/scada/abb_wserver_exec
CVE: CVE-2019-5621
Published: 2020-04-29
Description: ABBS Software Audio Media Player version 3.1 suffers from an instance of CWE-121: Stack-based Buffer Overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.rapid7.com/db/modules/exploit/windows/fileformat/abbs_amp_lst; https://www.rapid7.com/db/modules/exploit/windows/fileformat/abbs_amp_lst
CVE: CVE-2019-5622
Published: 2020-04-29
Description: Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-798: Use of Hard-coded Credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.rapid7.com/db/modules/exploit/linux/misc/accellion_fta_mpipe2; https://www.rapid7.com/db/modules/exploit/linux/misc/accellion_fta_mpipe2
CVE: CVE-2019-5623
Published: 2020-04-29
Description: Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78
References: https://www.rapid7.com/db/modules/exploit/linux/misc/accellion_fta_mpipe2; https://www.rapid7.com/db/modules/exploit/linux/misc/accellion_fta_mpipe2
CVE: CVE-2020-12283
Published: 2020-04-30
Description: Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.md; https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64; https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1
CVE: CVE-2020-9387
Published: 2020-04-30
Description: In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://bugs.launchpad.net/mahara/+bug/1836984; https://mahara.org/interaction/forum/topic.php?id=8612; https://bugs.launchpad.net/mahara/+bug/1836984
CVE: CVE-2019-19215
Published: 2020-04-30
Description: A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have unspecified impact via vectors related to the configured IP address or SMTP server.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://herolab.usd.de/en/security-advisories/; https://www.bmc.com/it-solutions/control-m.html; https://herolab.usd.de/en/security-advisories/
CVE: CVE-2019-19216
Published: 2020-04-30
Description: BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://herolab.usd.de/security-advisories/usd-2019-0060/; https://herolab.usd.de/security-advisories/usd-2019-0060/
CVE: CVE-2019-19217
Published: 2020-04-30
Description: BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://herolab.usd.de/security-advisories/usd-2019-0059/; https://herolab.usd.de/security-advisories/usd-2019-0059/
CVE: CVE-2019-19218
Published: 2020-04-30
Description: BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522, CWE-732
References: https://herolab.usd.de/security-advisories/usd-2019-0066/; https://herolab.usd.de/security-advisories/usd-2019-0066/
CVE: CVE-2019-19219
Published: 2020-04-30
Description: BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download.
CVSS Score: 7.5 (HIGH)
References: https://herolab.usd.de/security-advisories/usd-2019-0065/; https://herolab.usd.de/security-advisories/usd-2019-0065/
CVE: CVE-2019-19220
Published: 2020-04-30
Description: BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://herolab.usd.de/security-advisories/usd-2019-0064/; https://herolab.usd.de/security-advisories/usd-2019-0064/
CVE: CVE-2020-12101
Published: 2020-04-30
Description: The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-276
References: http://packetstormsecurity.com/files/157534/xt-Commerce-5.4.1-6.2.1-6.2.2-Improper-Access-Control.html; http://seclists.org/fulldisclosure/2020/May/0; https://helpdesk.xt-commerce.com/index.php?/Knowledgebase/Article/View/1784/294/adressbuch-sicherheitspatch-17042020-fr-xtcommerce-51-bis-622
CVE: CVE-2020-6579
Published: 2020-04-30
Description: Cross-site scripting (XSS) vulnerability in mailhive/cloudbeez/cloudloader.php and mailhive/cloudbeez/cloudloader_core.php in the MailBeez plugin for ZenCart before 3.9.22 allows remote attackers to inject arbitrary web script or HTML via the cloudloader_mode parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://herolab.usd.de/security-advisories/usd-2019-0070/; https://herolab.usd.de/security-advisories/usd-2019-0070/
CVE: CVE-2020-6010
Published: 2020-04-30
Description: LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/163536/WordPress-LearnPress-SQL-Injection.html; https://plugins.trac.wordpress.org/browser/learnpress/trunk/readme.txt?rev=2288975; https://research.checkpoint.com/2020/e-learning-platforms-getting-schooled-multiple-vulnerabilities-in-wordpress-most-popular-learning-management-system-plugins/
CVE: CVE-2020-10691
Published: 2020-04-30
Description: An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691; https://github.com/ansible/ansible/pull/68596; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691
CVE: CVE-2020-11651
Published: 2020-04-30
Description: An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html; http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html
CVE: CVE-2020-11652
Published: 2020-04-30
Description: An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00047.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00070.html; http://packetstormsecurity.com/files/157560/Saltstack-3000.1-Remote-Code-Execution.html
CVE: CVE-2020-12050
Published: 2020-04-30
Description: SQLiteODBC 0.9996, as packaged for certain Linux distributions as 0.9996-4, has a race condition leading to root privilege escalation because any user can replace a /tmp/sqliteodbc$$ file with new contents that cause loading of an arbitrary library.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00013.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00026.html; http://www.ch-werner.de/sqliteodbc/
CVE: CVE-2020-1752
Published: 2020-04-30
Description: A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752; https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E; https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
CVE: CVE-2020-11015
Published: 2020-04-30
Description: A vulnerability has been disclosed in thinx-device-api IoT Device Management Server before version 2.5.0. Device MAC address can be spoofed. This means initial registration requests without UDID and spoofed MAC address may pass to create new UDID with same MAC address. Full impact needs to be reviewed further. Applies to all (mostly ESP8266/ESP32) users. This has been fixed in firmware version 2.5.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290, CWE-290
References: https://github.com/suculent/thinx-device-api/security/advisories/GHSA-5x54-39xq-cwvc; https://github.com/suculent/thinx-device-api/security/advisories/GHSA-5x54-39xq-cwvc
CVE: CVE-2019-0235
Published: 2020-04-30
Description: Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/157514/Apache-OFBiz-17.12.03-Cross-Site-Request-Forgery.html; https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/r392206f7cd131f0fc3f7c60a767ced93ced00411d55c1777c219c956%40%3Cnotifications.ofbiz.apache.org%3E
CVE: CVE-2019-12425
Published: 2020-04-30
Description: Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://lists.apache.org/thread.html/r0a0a701610b3bcdf[PII_REDACTED]adab3f1628bb9aa55cf29cd262ef5%40%3Ccommits.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r5181b[PII_REDACTED]7d3ce70891eeccfb6d6885309dffd7e0e59091817%40%3Cuser.ofbiz.apache.org%3E
CVE: CVE-2020-5871
Published: 2020-04-30
Description: On BIG-IP 14.1.0-14.1.2.3, undisclosed requests can lead to a denial of service (DoS) when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K43450419; https://support.f5.com/csp/article/K43450419
CVE: CVE-2020-5872
Published: 2020-04-30
Description: On BIG-IP 14.1.0-14.1.2.3, 14.0.0-14.0.1, 13.1.0-13.1.3.1, and 12.1.0-12.1.4.1, when processing TLS traffic with hardware cryptographic acceleration enabled on platforms with Intel QAT hardware, the Traffic Management Microkernel (TMM) may stop responding and cause a failover event.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K63558580; https://support.f5.com/csp/article/K63558580
CVE: CVE-2020-7136
Published: 2020-04-30
Description: A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provided a software update to resolve this vulnerability in HPE Smart Update Manager (SUM) prior to 8.5.6. Please visit the HPE Support Center at https://support.hpe.com/hpesc/public/home to download the latest version of HPE Smart Update Manager (SUM). Download the latest version of HPE Smart Update Manager (SUM) or download the latest Service Pack For ProLiant (SPP).
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03997en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03997en_us
CVE: CVE-2020-5873
Published: 2020-04-30
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy (scp) utility but does not have access to Advanced Shell (bash) can execute arbitrary commands using a maliciously crafted scp request.
CVSS Score: 7.2 (HIGH)
References: https://support.f5.com/csp/article/K03585731; https://support.f5.com/csp/article/K03585731
CVE: CVE-2020-5874
Published: 2020-04-30
Description: On BIG-IP APM 15.0.0-15.0.1.2, 14.1.0-14.1.2.3, and 14.0.0-14.0.1, in certain circumstances, an attacker sending specifically crafted requests to a BIG-IP APM virtual server may cause a disruption of service provided by the Traffic Management Microkernel(TMM).
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K46901953; https://support.f5.com/csp/article/K46901953
CVE: CVE-2020-5875
Published: 2020-04-30
Description: On BIG-IP 15.0.0-15.0.1 and 14.1.0-14.1.2.3, under certain conditions, the Traffic Management Microkernel (TMM) may generate a core file and restart while processing SSL traffic with an HTTP/2 full proxy.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K65372933; https://support.f5.com/csp/article/K65372933
CVE: CVE-2020-5876
Published: 2020-04-30
Description: On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, a race condition exists where mcpd and other processes may make unencrypted connection attempts to a new configuration sync peer. The race condition can occur when changing the ConfigSync IP address of a peer, adding a new peer, or when the Traffic Management Microkernel (TMM) first starts up.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319, CWE-362
References: https://support.f5.com/csp/article/K32121038; https://support.f5.com/csp/article/K32121038
CVE: CVE-2020-5877
Published: 2020-04-30
Description: On BIG-IP 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, malformed input to the DATAGRAM::tcp iRules command within a FLOW_INIT event may lead to a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K54200228; https://support.f5.com/csp/article/K54200228
CVE: CVE-2020-5878
Published: 2020-04-30
Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.1, and 14.1.0-14.1.2.3, Traffic Management Microkernel (TMM) may restart on BIG-IP Virtual Edition (VE) while processing unusual IP traffic.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K35750231; https://support.f5.com/csp/article/K35750231
CVE: CVE-2020-5879
Published: 2020-04-30
Description: On BIG-IP ASM 11.6.1-11.6.5.1, under certain configurations, the BIG-IP system sends data plane traffic to back-end servers unencrypted, even when a Server SSL profile is applied.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://support.f5.com/csp/article/K88474783; https://support.f5.com/csp/article/K88474783
CVE: CVE-2020-5880
Published: 2020-04-30
Description: Om BIG-IP 15.0.0-15.0.1.3 and 14.1.0-14.1.2.3, the restjavad process may expose a way for attackers to upload arbitrary files on the BIG-IP system, bypassing the authorization system. Resulting error messages may also reveal internal paths of the server.
CVSS Score: 7.1 (HIGH)
CWE: CWE-434
References: https://support.f5.com/csp/article/K94325657; https://support.f5.com/csp/article/K94325657
CVE: CVE-2020-5881
Published: 2020-04-30
Description: On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, and 13.1.0-13.1.3.3, when the BIG-IP Virtual Edition (VE) is configured with VLAN groups and there are devices configured with OSPF connected to it, the Network Device Abstraction Layer (NDAL) Interfaces can lock up and in turn disrupting the communication between the mcpd and tmm processes.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K03386032; https://support.f5.com/csp/article/K03386032
CVE: CVE-2020-5882
Published: 2020-04-30
Description: On BIG-IP 15.0.0-15.0.1.3, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, 12.1.0-12.1.5, and 11.6.1-11.6.5.1, under certain conditions, the Intel QuickAssist Technology (QAT) cryptography driver may produce a Traffic Management Microkernel (TMM) core file.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K43815022; https://support.f5.com/csp/article/K43815022
CVE: CVE-2020-5883
Published: 2020-04-30
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 14.0.0-14.0.1, and 13.1.0-13.1.3.1, when a virtual server is configured with HTTP explicit proxy and has an attached HTTP_PROXY_REQUEST iRule, POST requests sent to the virtual server cause an xdata memory leak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://support.f5.com/csp/article/K12234501; https://support.f5.com/csp/article/K12234501
CVE: CVE-2020-5884
Published: 2020-04-30
Description: On versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.4, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the default deployment mode for BIG-IP high availability (HA) pair mirroring is insecure. This is a control plane issue that is exposed only on the network used for mirroring.
CVSS Score: 9.1 (CRITICAL)
References: https://support.f5.com/csp/article/K72540690; https://support.f5.com/csp/article/K72540690
CVE: CVE-2020-5885
Published: 2020-04-30
Description: On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems set up for connection mirroring in a high availability (HA) pair transfer sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319, CWE-326
References: https://support.f5.com/csp/article/K17663061; https://support.f5.com/csp/article/K17663061
CVE: CVE-2020-5886
Published: 2020-04-30
Description: On versions 15.0.0-15.1.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1, BIG-IP systems setup for connection mirroring in a High Availability (HA) pair transfers sensitive cryptographic objects over an insecure communications channel. This is a control plane issue which is exposed only on the network used for connection mirroring.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-319, CWE-326
References: https://support.f5.com/csp/article/K65720640; https://support.f5.com/csp/article/K65720640
CVE: CVE-2020-5887
Published: 2020-04-30
Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for remote attackers to access local daemons and bypass port lockdown settings.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-668
References: https://support.f5.com/csp/article/K10251014; https://support.f5.com/csp/article/K10251014
CVE: CVE-2020-5889
Published: 2020-04-30
Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K24415506; https://support.f5.com/csp/article/K24415506
CVE: CVE-2020-5891
Published: 2020-04-30
Description: On BIG-IP 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, undisclosed HTTP/2 requests can lead to a denial of service when sent to a virtual server configured with the Fallback Host setting and a server-side HTTP/2 profile.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K58494243; https://support.f5.com/csp/article/K58494243
CVE: CVE-2020-5893
Published: 2020-04-30
Description: In versions 7.1.5-7.1.8, when a user connects to a VPN using BIG-IP Edge Client over an unsecure network, BIG-IP Edge Client responds to authentication requests over HTTP while sending probes for captive portal detection.
CVSS Score: 3.7 (LOW)
CWE: CWE-319
References: https://support.f5.com/csp/article/K97733133; https://support.f5.com/csp/article/K97733133
CVE: CVE-2020-11025
Published: 2020-04-30
Description: In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code to be executed. Exploitation requires an authenticated user. This has been patched in version 5.4.1, along with all the previously affected versions via a minor release (5.3.3, 5.2.6, 5.1.5, 5.0.9, 4.9.14, 4.8.13, 4.7.17, 4.6.18, 4.5.21, 4.4.22, 4.3.23, 4.2.27, 4.1.30, 4.0.30, 3.9.31, 3.8.33, 3.7.33).
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-4mhg-j6fx-5g3c; https://wordpress.org/support/wordpress-version/version-5-4-1/#security-updates; https://www.debian.org/security/2020/dsa-4677
CVE: CVE-2020-1817
Published: 2020-04-30
Description: Huawei PCManager with versions earlier than 10.0.1.36 has a privilege escalation vulnerability. Due to improper permission management of specific files, local attackers with low permissions can inject commands to exploit this vulnerability. Successful exploit may cause privilege escalation.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200429-01-pcmanager-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200429-01-pcmanager-en
CVE: CVE-2020-5888
Published: 2020-04-30
Description: On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, BIG-IP Virtual Edition (VE) may expose a mechanism for adjacent network (layer 2) attackers to access local daemons and bypass port lockdown settings.
CVSS Score: 8.1 (HIGH)
References: https://support.f5.com/csp/article/K73274382; https://support.f5.com/csp/article/K73274382
CVE: CVE-2020-5890
Published: 2020-04-30
Description: On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.3, and 12.1.0-12.1.5.1 and BIG-IQ 5.2.0-7.1.0, when creating a QKView, credentials for binding to LDAP servers used for remote authentication of the BIG-IP administrative interface will not fully obfuscate if they contain whitespace.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.f5.com/csp/article/K03318649; https://support.f5.com/csp/article/K03318649
CVE: CVE-2020-5892
Published: 2020-04-30
Description: In versions 7.1.5-7.1.8, the BIG-IP Edge Client components in BIG-IP APM, Edge Gateway, and FirePass legacy allow attackers to obtain the full session ID from process memory.
CVSS Score: 6.7 (MEDIUM)
References: https://support.f5.com/csp/article/K15838353; https://support.f5.com/csp/article/K15838353