rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-8427 
In Unitrends Backup before 10.4.1, an HTTP request parameter was not properly sanitized, allowing for SQL injection that resulted in an authentication bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-17T14:56:51.000Z
CVE-2020-8428 
fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if the socket is being moved to a new parent directory and its old parent directory is being removed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T23:43:41.000Z
CVE-2020-8429 
The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs function was used as a variable in a command to read log files; however, due to poor input sanitisation, it was possible to bypass a replacement and break out of the command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-11T17:15:42.000Z
CVE-2020-8430 
Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can use rurl=//example.com instead of rurl=https://example.com in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-13T15:08:46.000Z
CVE-2020-8432 
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T18:33:31.000Z
CVE-2020-8434 
Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode it to a client-side cookie for persistent session authentication. By knowing the key and algorithm, an attacker can select any username, encrypt it, base64 encode it, and save it in their browser with the correct JICSLoginCookie cookie format to impersonate any real user in the JICS database without the need for authenticating (or verifying with MFA if implemented).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-19T12:29:46.000Z
CVE-2020-8435 
An issue was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress. There is SQL injection via the rm_analytics_show_form rm_form_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:32:59.000Z
CVE-2020-8436 
XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rm_form_id, rm_tr, or form_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:31:59.000Z
CVE-2020-8437 
The bencoding parser in BitTorrent uTorrent through 3.5.5 (build 45505) misparses nested bencoded dictionaries, which allows a remote attacker to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-02T18:33:37.000Z
CVE-2020-8438 
Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat${IFS} substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-29T22:06:30.000Z
CVE-2020-8439 
Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-07T00:26:41.000Z
CVE-2020-8440 
controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-31T13:45:53.000Z
CVE-2020-8441 
JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-19T16:19:12.000Z
CVE-2020-8442 
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a heap-based buffer overflow in the rootcheck decoder component via an authenticated client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:34:40.000Z
CVE-2020-8443 
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer overflow during the cleaning of crafted syslog msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:34:28.000Z
CVE-2020-8444 
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of ossec-alert formatted msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:33:52.000Z
CVE-2020-8445 
In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines (\n) are permitted in messages processed by ossec-analysisd, it may be possible to inject nested events into the ossec log. Use of terminal control characters may allow obfuscating events or executing commands when viewed through vulnerable terminal emulators. This may be an unauthenticated remote attack for certain types and origins of logged data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:33:43.000Z
CVE-2020-8446 
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with write access) via crafted syscheck messages written directly to the analysisd UNIX domain socket by a local user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:33:32.000Z
CVE-2020-8447 
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free during processing of syscheck formatted msgs (received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:33:18.000Z
CVE-2020-8448 
In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (NULL pointer dereference) via crafted messages written directly to the analysisd UNIX domain socket by a local user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-30T00:32:38.000Z
CVE-2020-8449 
An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-04T19:50:21.000Z
CVE-2020-8450 
An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-04T19:51:21.000Z
CVE-2020-8461 
A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token.
Problem types: description: CSRF Protection Bypass
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2020-12-17T21:05:45.000Z
CVE-2020-8462 
A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper with the web interface of the product.
Problem types: description: XSS
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2020-12-17T21:05:45.000Z
CVE-2020-8463 
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization check for anonymous users by manipulating request paths.
Problem types: description: Authorization Bypass
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2020-12-17T21:05:46.000Z
CVE-2020-8464 
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come from the localhost which could expose the product's admin interface to users who would not normally have access.
Problem types: description: Authentication Bypass
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2020-12-17T21:05:46.000Z
CVE-2020-8465 
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combination of CSRF bypass (CVE-2020-8461) and authentication bypass (CVE-2020-8464) to execute code as user root.
Problem types: description: Command Execution
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2020-12-17T21:05:47.000Z
CVE-2020-8466 
A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.
Problem types: description: Unauthenticated Command Injection
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2020-12-17T21:05:48.000Z
CVE-2020-8467 
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
Problem types: description: RCE
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan, Trend Micro Apex One
Published: 2020-03-18T00:30:43.000Z
CVE-2020-8468 
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation escape vulnerability which could allow an attacker to manipulate certain agent client components. An attempted attack requires user authentication.
Problem types: description: Content Validation Escape
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS)
Published: 2020-03-18T00:30:43.000Z
CVE-2020-8469 
Trend Micro Password Manager for Windows version 5.0 is affected by a DLL hijacking vulnerability would could potentially allow an attacker privleged escalation.
Problem types: description: DLL Hijacking
Affected products: vendor: Trend Micro
product: Trend Micro Password Manager for Windows
Published: 2020-03-12T23:05:15.000Z
CVE-2020-8470 
Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) server contains a vulnerable service DLL file that could allow an attacker to delete any file on the server with SYSTEM level privileges. Authentication is not required to exploit this vulnerability.
Problem types: description: Directory Traversal
Affected products: vendor: Trend Micro
product: Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS)
Published: 2020-03-18T00:30:44.000Z
CVE-2020-8471 ABB Central Licensing System - Weak File Permissions
For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, weak file permissions allow an authenticated attacker to block the license handling, escalate his/her privileges and execute arbitrary code.
Problem types: cwe_id: CWE-275
description: CWE-275 Permission Issues
Affected products: vendor: ABB
product: Central Licensing System
vendor: ABB
product: ABB Ability System 800xA
vendor: ABB
product: Compact HMI
vendor: ABB
product: Control Builder Safe
vendor: ABB
product: Symphony Plus S+ Operations
vendor: ABB
product: Symphony Plus S+ Engineering
vendor: ABB
product: Composer Harmony
vendor: ABB
product: Composer Melody
vendor: ABB
product: Harmony OPC Server Standalone
vendor: ABB
product: Advant OCS Control Builder A
vendor: ABB
product: Composer CTK
vendor: ABB
product: AdvaBuild
vendor: ABB
product: OPC Server for Mod 300 (non-800xA)
vendor: ABB
product: OPC Data Link
vendor: ABB
product: Knowledge Manager
vendor: ABB
product: Manufacturing Operations Management
vendor: ABB
product: Advant  OCS AC 100 OPS Server
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-29T01:30:43.000Z
CVE-2020-8472 ABB System 800xA Weak File Permissions - different products
Insufficient folder permissions used by system functions in ABB System 800xA products OPCServer for AC800M (versions 6.0 and earlier) and Control Builder M Professional, MMSServer for AC800M, Base Software for SoftControl (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploited the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: ABB
product: OPC Server for AC 800M
vendor: ABB
product: Control Builder M Professional
vendor: ABB
product: MMS Server for AC 800M
vendor: ABB
product: Base Software for SoftControl
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2020-04-28T23:52:41.000Z
CVE-2020-8473 ABB System 800xA Weak File Permissions - ABB System 800xA Base
Insufficient folder permissions used by system functions in ABB System 800xA Base (version 6.1 and earlier) allow low privileged users to read, modify, add and delete system and application files. An authenticated attacker who successfully exploit the vulnerabilities could escalate his/her privileges, cause system functions to stop and to corrupt user applications.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: ABB
product: System 800xA Base
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-28T23:52:44.000Z
CVE-2020-8474 ABB System 800xA Weak Registry Permissions
Weak Registry permissions in ABB System 800xA Base allow low privileged users to read and modify registry settings related to control system functionality, allowing an authenticated attacker to cause system functions to stop or malfunction.
Problem types: cwe_id: CWE-275
description: CWE-275 Permission Issues
Affected products: vendor: ABB
product: System 800xA Base
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-22T14:18:35.000Z
CVE-2020-8475 ABB Central Licensing System - Denial of Service Vulnerability
For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to block license handling by sending specially crafted messages to the CLS web service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: ABB
product: Central Licensing System
vendor: ABB
product: ABB Ability System 800xA
vendor: ABB
product: Compact HMI
vendor: ABB
product: Control Builder Safe
vendor: ABB
product: Symphony Plus S+ Operations
vendor: ABB
product: Symphony Plus S+ Engineering
vendor: ABB
product: Composer Harmony
vendor: ABB
product: Composer Melody
vendor: ABB
product: Harmony OPC Server Standalone
vendor: ABB
product: Advant OCS Control Builder A
vendor: ABB
product: Composer CTK
vendor: ABB
product: AdvaBuild
vendor: ABB
product: OPC Server for Mod 300 (non-800xA)
vendor: ABB
product: OPC Data Link
vendor: ABB
product: Knowledge Manager
vendor: ABB
product: Manufacturing Operations Management
vendor: ABB
product: Advant  OCS AC 100 OPS Server
vendor: ABB
product: ABB  Ability™ SCADAvantage
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2020-04-29T00:00:00.000Z
CVE-2020-8476 ABB Central Licensing System - Elevation of Privilege Vulnerability
For the Central Licensing Server component used in ABB products ABB Ability™ System 800xA and related system extensions versions 5.1, 6.0 and 6.1, Compact HMI versions 5.1 and 6.0, Control Builder Safe 1.0, 1.1 and 2.0, Symphony Plus -S+ Operations 3.0 to 3.2 Symphony Plus -S+ Engineering 1.1 to 2.2, Composer Harmony 5.1, 6.0 and 6.1, Melody Composer 5.3, 6.1/6.2 and SPE for Melody 1.0SPx (Composer 6.3), Harmony OPC Server (HAOPC) Standalone 6.0, 6.1 and 7.0, ABB Ability™ System 800xA/ Advant® OCS Control Builder A 1.3 and 1.4, Advant® OCS AC100 OPC Server 5.1, 6.0 and 6.1, Composer CTK 6.1 and 6.2, AdvaBuild 3.7 SP1 and SP2, OPCServer for MOD 300 (non-800xA) 1.4, OPC Data Link 2.1 and 2.2, Knowledge Manager 8.0, 9.0 and 9.1, Manufacturing Operations Management 1812 and 1909, ABB AbilityTM SCADAvantage versions 5.1 to 5.6.5, a weakness in validation of input exists that allows an attacker to alter licenses assigned to the system nodes by sending specially crafted messages to the CLS web service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: ABB
product: Central Licensing System
vendor: ABB
product: ABB Ability System 800xA
vendor: ABB
product: Compact HMI
vendor: ABB
product: Control Builder Safe
vendor: ABB
product: Symphony Plus S+ Operations
vendor: ABB
product: Symphony Plus S+ Engineering
vendor: ABB
product: Composer Harmony
vendor: ABB
product: Composer Melody
vendor: ABB
product: Harmony OPC Server Standalone
vendor: ABB
product: Advant OCS Control Builder A
vendor: ABB
product: Composer CTK
vendor: ABB
product: AdvaBuild
vendor: ABB
product: OPC Server for Mod 300 (non-800xA)
vendor: ABB
product: OPC Data Link
vendor: ABB
product: Knowledge Manager
vendor: ABB
product: Manufacturing Operations Management
vendor: ABB
product: Advant  OCS AC 100 OPS Server
vendor: ABB
product: ABB  Ability™ SCADAvantage
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2020-04-29T00:00:00.000Z
CVE-2020-8477 ABB System 800xA Information Manager Remote Code Execution
The installations for ABB System 800xA Information Manager versions 5.1, 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user, which might lead to execution of arbitrary code.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-489
description: CWE-489 Leftover Debug Code
Affected products: vendor: ABB
product: System 800xA Information Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-04-22T14:46:23.000Z