deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-13339
Published: 2020-10-08
Description: An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13339.json; https://gitlab.com/gitlab-org/gitlab/-/issues/118477; https://hackerone.com/reports/758653
CVE: CVE-2020-13340
Published: 2020-10-08
Description: An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13340.json; https://gitlab.com/gitlab-org/gitlab/-/issues/233473; https://hackerone.com/reports/950190
CVE: CVE-2020-13344
Published: 2020-10-08
Description: An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-522
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13344.json; https://gitlab.com/gitlab-org/gitlab/-/issues/17817; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13344.json
CVE: CVE-2020-15646
Published: 2020-10-08
Description: If an attacker intercepts Thunderbird's initial attempt to perform automatic account setup using the Microsoft Exchange autodiscovery mechanism, and the attacker sends a crafted response, then Thunderbird sends username and password over https to a server controlled by the attacker. This vulnerability affects Thunderbird < 68.10.0.
CVSS Score: 5.9 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1606610; https://www.mozilla.org/security/advisories/mfsa2020-26/; https://bugzilla.mozilla.org/show_bug.cgi?id=1606610
CVE: CVE-2020-24301
Published: 2020-10-08
Description: Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testing and not believed to be widely used for any production purposes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/jamesagnew/hapi-fhir/issues/2026; https://github.com/jamesagnew/hapi-fhir/issues/2026
CVE: CVE-2020-4280
Published: 2020-10-08
Description: IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 176140.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: http://packetstormsecurity.com/files/159589/QRadar-RemoteJavaScript-Deserialization.html; http://seclists.org/fulldisclosure/2020/Oct/18; https://exchange.xforce.ibmcloud.com/vulnerabilities/176140
CVE: CVE-2020-4799
Published: 2020-10-08
Description: IBM Informix spatial 14.10 could allow a local user to execute commands as a privileged user due to an out of bounds write vulnerability. IBM X-Force ID: 189460.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189460; https://www.ibm.com/support/pages/node/6343587; https://exchange.xforce.ibmcloud.com/vulnerabilities/189460
CVE: CVE-2020-5389
Published: 2020-10-08
Description: Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerability. Authenticated low privileged OMIMSCC users may be able to retrieve sensitive information from the logs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://www.dell.com/support/article/en-de/sln322859/dsa-2020-224-dell-emc-openmanage-integration-for-microsoft-system-center-information-disclosure-vulnerability?lang=en; https://www.dell.com/support/article/en-de/sln322859/dsa-2020-224-dell-emc-openmanage-integration-for-microsoft-system-center-information-disclosure-vulnerability?lang=en
CVE: CVE-2020-10816
Published: 2020-10-08
Description: Zoho ManageEngine Applications Manager 14780 and before allows a remote unauthenticated attacker to register managed servers via AAMRequestProcessor servlet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://gitlab.com/eLeN3Re/CVE-2020-10816; https://www.manageengine.com/au/products/applications_manager/security-updates/security-updates-cve-2020-10816.html; https://gitlab.com/eLeN3Re/CVE-2020-10816
CVE: CVE-2020-26802
Published: 2020-10-08
Description: forma.lms 2.3.0.2 is affected by Cross Site Request Forgery (CSRF) in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/48494; https://www.exploit-db.com/exploits/48494
CVE: CVE-2020-9048
Published: 2020-10-08
Description: A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-285, CWE-732
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01; https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01
CVE: CVE-2020-1914
Published: 2020-10-08
Description: A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-670, CWE-670
References: https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc; https://www.facebook.com/security/advisories/cve-2020-1914; https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc
CVE: CVE-2020-15242
Published: 2020-10-08
Description: Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435; https://github.com/zeit/next.js/releases/tag/v9.5.4; https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435
CVE: CVE-2020-15241
Published: 2020-10-08
Description: TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601, CWE-79
References: https://github.com/TYPO3/Fluid/commit/9ef6a8ffff2e812025fc0701b4ce72eea6911a3d; https://github.com/TYPO3/Fluid/security/advisories/GHSA-7733-hjv6-4h47; https://typo3.org/security/advisory/typo3-core-sa-2019-013
CVE: CVE-2020-26894
Published: 2020-10-08
Description: LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's "shell()" function, it will attempt to search for "cmd.exe" in the folder of the current application and run the malicious "cmd.exe".
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/livecode/livecode/pull/7454; https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/; https://quality.livecode.com/show_bug.cgi?id=22942
CVE: CVE-2019-19115
Published: 2020-10-08
Description: An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to execute code with SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://safebreach.com/Post/Nahimic-APO-Software-Component-Driver-Deployed-with-MSI-Computers-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-19115; https://safebreach.com/Post/Nahimic-APO-Software-Component-Driver-Deployed-with-MSI-Computers-DLL-Search-Order-Hijacking-and-Potential-Abuses-CVE-2019-19115
CVE: CVE-2020-15243
Published: 2020-10-08
Description: Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have installed and activated the Web API plugin. Users of Smartstore 4.0.0 and 4.0.1 must merge their repository with 4.0.x or overwrite the file SmartStore.Web.Framework in the */bin* directory of the deployed shop with this file. As a workaround without updating uninstall the Web API plugin to close this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287, CWE-306
References: https://github.com/smartstore/SmartStoreNET/security/advisories/GHSA-8g9m-jx26-qp4h; https://github.com/smartstore/SmartStoreNET/security/advisories/GHSA-8g9m-jx26-qp4h
CVE: CVE-2020-13626
Published: 2020-10-09
Description: OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in order to send an SMS message when the SMS application is locked.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-862
References: https://medium.com/%40bugsbunnyy1107/the-tell-tale-of-cve-in-oneplus-phones-91e97342a8b5; https://support.oneplus.com/app/answers/detail/a_id/301/~/how-to-use-app-locker; https://medium.com/%40bugsbunnyy1107/the-tell-tale-of-cve-in-oneplus-phones-91e97342a8b5
CVE: CVE-2020-15838
Published: 2020-10-09
Description: The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://dbeta.com/2020/10/05/PrivilegeEscalationInAutomateAgent; https://www.connectwise.com/company/trust/security-bulletins; https://dbeta.com/2020/10/05/PrivilegeEscalationInAutomateAgent
CVE: CVE-2020-26162
Published: 2020-10-09
Description: Xerox WorkCentre EC7836 before 073[PII_REDACTED]0 and EC7856 before 073[PII_REDACTED]0 devices allow XSS via Description pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://securitydocs.business.xerox.com; https://securitydocs.business.xerox.com/wp-content/uploads/2019/09/cert_Security_Mini_Bulletin_XRX19Y_for_WorkCentre-EC7836-EC7856.pdf; https://securitydocs.business.xerox.com
CVE: CVE-2020-26522
Published: 2020-10-09
Description: A cross-site request forgery (CSRF) vulnerability in mod/user/act_user.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/159520/Garfield-Petshop-2020-10-01-Cross-Site-Request-Forgery.html; http://rysec.io/adv/Petshop_AddAdmin_Exploit.txt; https://demo.detapos.co.id/petshop/
CVE: CVE-2020-26897
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062357/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0045; https://kb.netgear.com/000062357/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0045
CVE: CVE-2020-26898
Published: 2020-10-09
Description: NETGEAR RAX40 devices before 1.0.3.80 are affected by incorrect configuration of security settings.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062356/Security-Advisory-for-Security-Misconfiguration-on-RAX40-PSV-2019-0267; https://kb.netgear.com/000062356/Security-Advisory-for-Security-Misconfiguration-on-RAX40-PSV-2019-0267
CVE: CVE-2020-26899
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062355/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-WiFi-Systems-PSV-2020-0030; https://kb.netgear.com/000062355/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-WiFi-Systems-PSV-2020-0030
CVE: CVE-2020-26900
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062354/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0032; https://kb.netgear.com/000062354/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0032
CVE: CVE-2020-26901
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of sensitive information. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062353/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-WiFi-Systems-PSV-2020-0036; https://kb.netgear.com/000062353/Security-Advisory-for-Sensitive-Information-Disclosure-on-Some-WiFi-Systems-PSV-2020-0036
CVE: CVE-2020-26902
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000062352/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0041; https://kb.netgear.com/000062352/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0041
CVE: CVE-2020-26903
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062351/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0043; https://kb.netgear.com/000062351/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0043
CVE: CVE-2020-26904
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062350/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0046; https://kb.netgear.com/000062350/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0046
CVE: CVE-2020-26905
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062349/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0047; https://kb.netgear.com/000062349/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0047
CVE: CVE-2020-26906
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by disclosure of administrative credentials. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.10.11, RBR850 before 3.2.10.11, and RBS850 before 3.2.10.11.
CVSS Score: 9.6 (CRITICAL)
References: https://kb.netgear.com/000062348/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0048; https://kb.netgear.com/000062348/Security-Advisory-for-Admin-Credential-Disclosure-on-Some-WiFi-Systems-PSV-2020-0048
CVE: CVE-2020-26907
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-77
References: https://kb.netgear.com/000062347/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0264; https://kb.netgear.com/000062347/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0264
CVE: CVE-2020-26908
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by authentication bypass. This affects D6200 before 1.1.00.36, D7000 before 1.0.1.74, PR2000 before 1.0.0.30, R6020 before 1.0.0.42, R6050 before 1.0.1.22, JR6150 before 1.0.1.22, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6230 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R69002 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS Score: 9.4 (CRITICAL)
References: https://kb.netgear.com/000062346/Security-Advisory-for-Authentication-Bypass-Some-Modems-and-Routers-PSV-2019-0001; https://kb.netgear.com/000062346/Security-Advisory-for-Authentication-Bypass-Some-Modems-and-Routers-PSV-2019-0001
CVE: CVE-2020-26909
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.58 and R7500v2 before 1.0.3.48.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000062344/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0163; https://kb.netgear.com/000062344/Security-Advisory-for-Pre-Authentication-Command-Injection-on-Some-Routers-PSV-2020-0163
CVE: CVE-2020-26910
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.10, RBK752 before 3.2.15.25, RBR750 before 3.2.15.25, RBS750 before 3.2.15.25, RBK852 before 3.2.15.25, RBR850 before 3.2.15.25, and RBS850 before 3.2.15.25.
CVSS Score: 8.4 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000062343/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0031; https://kb.netgear.com/000062343/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-WiFi-Systems-PSV-2020-0031
CVE: CVE-2020-26911
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by lack of access control at the function level. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS Score: 8.3 (HIGH)
References: https://kb.netgear.com/000062342/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Routers-PSV-2019-0016; https://kb.netgear.com/000062342/Security-Advisory-for-Missing-Function-Level-Access-Control-on-Some-Routers-PSV-2019-0016
CVE: CVE-2020-26912
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by CSRF. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS Score: 7.5 (HIGH)
CWE: CWE-352
References: https://kb.netgear.com/000062341/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2019-0018; https://kb.netgear.com/000062341/Security-Advisory-for-Cross-Site-Request-Forgery-on-Some-Routers-PSV-2019-0018
CVE: CVE-2020-26913
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6100 before 1.0.0.63, R7800 before 1.0.2.60, R8900 before 1.0.4.26, R9000 before 1.0.4.26, RBK20 before 2.3.0.28, RBR20 before 2.3.0.28, RBS20 before 2.3.0.28, RBK50 before 2.3.0.32, RBR50 before 2.3.0.32, RBS50 before 2.3.0.32, RBK40 before 2.3.0.28, RBR40 before 2.3.0.28, RBS40 before 2.3.0.28, SRK60 before 2.2.2.20, SRR60 before 2.2.2.20, SRS60 before 2.2.2.20, WN3000RPv2 before 1.0.0.78, WNDR4300v2 before 1.0.0.58, WNDR4500v3 before 1.0.0.58, WNR2000v5 before 1.0.0.70, XR450 before 2.3.2.40, and XR500 before 2.3.2.40.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000062340/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2018-0140; https://kb.netgear.com/000062340/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-and-WiFi-Systems-PSV-2018-0140
CVE: CVE-2020-26914
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D6200 before 1.1.00.38, D7000 before 1.0.1.78, JR6150 before 1.0.1.24, R6020 before 1.0.0.42, R6050 before 1.0.1.24, R6080 before 1.0.0.42, R6120 before 1.0.0.66, R6220 before 1.1.0.100, R6260 before 1.1.0.64, R6700v2 before 1.2.0.62, R6800 before 1.2.0.62, R6900v2 before 1.2.0.62, R7450 before 1.2.0.62, and WNR2020 before 1.1.0.62.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77
References: https://kb.netgear.com/000062339/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2019-0014; https://kb.netgear.com/000062339/Security-Advisory-for-Post-Authentication-Command-Injection-on-Some-Routers-PSV-2019-0014
CVE: CVE-2020-26915
Published: 2020-10-09
Description: Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.68, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBK50 before 2.3.5.30, RBR50 before 2.3.5.30, RBS50 before 2.3.5.30, XR500 before 2.3.2.56, and XR700 before 1.0.1.10.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000062338/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-WiFi-Systems-PSV-2018-0554; https://kb.netgear.com/000062338/Security-Advisory-for-Stored-Cross-Site-Scripting-on-Some-Routers-and-WiFi-Systems-PSV-2018-0554