rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-11853 Arbitrary code execution vulnerability on multiple Micro Focus products
Arbitrary code execution vulnerability affecting multiple Micro Focus products. 1.) Operation Bridge Manager affecting version: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, versions 10.6x and 10.1x and older versions. 2.) Application Performance Management affecting versions : 9.51, 9.50 and 9.40 with uCMDB 10.33 CUP 3 3.) Data Center Automation affected version 2019.11 4.) Operations Bridge (containerized) affecting versions: 2019.11, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05, 2018.02, 2017.11 5.) Universal CMDB affecting version: 2020.05, 2019.11, 2019.05, 2019.02, 2018.11, 2018.08, 2018.05, 11, 10.33, 10.32, 10.31, 10.30 6.) Hybrid Cloud Management affecting version 2020.05 7.) Service Management Automation affecting version 2020.5 and 2020.02. The vulnerability could allow to execute arbitrary code.
Problem types: description: Arbitrary code execution
Affected products: vendor: Micro Focus
product: Operation Bridge Manager
vendor: Micro Focus
product: Application Performance Management
vendor: Micro Focus
product: Data Center Automation
vendor: Micro Focus
product: Operations Bridge (containerized)
vendor: Micro Focus
product: Universal CMDB
vendor: Micro Focus
product: Hybrid Cloud Management
vendor: Micro Focus
product: Service Management Automation
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability.
Published: 2020-10-22T20:37:51.000Z
CVE-2020-11854 Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products.
Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.
Problem types: description: Arbitrary code execution
Affected products: vendor: Micro Focus
product: Application Performance Management
vendor: Micro Focus
product: Operation Bridge (containerized)
vendor: Micro Focus
product: Operation Bridge Manager
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability
Published: 2020-10-27T16:29:44.000Z
CVE-2020-11855 
An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow local attackers on the OBR host to execute code with escalated privileges.
Problem types: description: Authorization Bypass.
Affected products: vendor: n/a
product: Operation Bridge Reporter.
Published: 2020-09-22T13:54:11.000Z
CVE-2020-11856 
Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of OBR.
Problem types: description: Arbitrary code execution.
Affected products: vendor: n/a
product: Operation Bridge Reporter.
Published: 2020-09-22T14:03:47.000Z
CVE-2020-11857 
An Authorization Bypass vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attackers to access the OBR host as a non-admin user
Problem types: description: Authorization Bypass.
Affected products: vendor: n/a
product: Operation Bridge Reporter.
Published: 2020-09-22T14:00:55.000Z
CVE-2020-11858 Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products.
Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges.
Problem types: description: Code execution with escalated privileges
Affected products: vendor: Micro Focus
product: Operation Bridge (containerized)
vendor: Micro Focus
product: Operation Bridge Manager
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Micro Focus would like to thank Pedro Ribeiro from Agile Information Security working with Trend Micro Zero Day Initiative for discovering and reporting the vulnerability
Published: 2020-10-27T16:45:12.000Z
CVE-2020-11859 Potential Cross Site Scripting vulnerability in OpenText iManager
Improper Input Validation vulnerability in OpenText iManager allows Cross-Site Scripting (XSS). This issue affects iManager before 3.2.3
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: OpenText
product: iManager
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-11-06T14:10:59.925Z
CVE-2020-11860 
Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS)
Problem types: description: Cross-Site Scripting.
Affected products: vendor: Micro Focus
product: ArcSight Logger
Published: 2020-11-17T00:54:23.000Z
CVE-2020-11861 
Unauthorized escalation of local privileges vulnerability on Micro Focus Operation Agent, affecting all versions prior to versions 12.11. The vulnerability could be exploited to escalate the local privileges and gain root access on the system.
Problem types: description: Unauthorized escalation of local privileges
Affected products: vendor: n/a
product: Operations Agent
Published: 2020-09-18T20:07:34.000Z
CVE-2020-11862 Insecure renegotiation in SSL protocol caused Denial of service attack in Privileged Account Manager
Allocation of Resources Without Limits or Throttling vulnerability in OpenText NetIQ Privileged Account Manager on Linux, Windows, 64 bit allows Flooding.This issue affects NetIQ Privileged Account Manager: before 3.7.0.2.


Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: OpenText
product: NetIQ Privileged Account Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2024-03-13T21:32:24.413Z
CVE-2020-11863 
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 1 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-11T15:08:44.000Z
CVE-2020-11864 
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of service (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-11T15:09:50.000Z
CVE-2020-11865 
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows out-of-bounds memory access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-11T15:10:45.000Z
CVE-2020-11866 
libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows a use-after-free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-11T15:12:03.000Z
CVE-2020-11867 
Audacity through 2.3.3 saves temporary files to /var/tmp/audacity-$USER by default. After Audacity creates the temporary directory, it sets its permissions to 755. Any user on the system can read and play the temporary audio .au files located there.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-30T21:21:28.000Z
CVE-2020-11868 
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T03:31:05.000Z
CVE-2020-11869 
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T19:00:34.000Z
CVE-2020-11872 
The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T04:24:28.000Z
CVE-2020-11873 
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A stack-based buffer overflow in the logging tool could allow an attacker to gain privileges. The LG ID is LVE-SMP-200005 (April 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T13:23:54.000Z
CVE-2020-11874 
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. Attackers can bypass Factory Reset Protection (FRP). The LG ID is LVE-SMP-200004 (March 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T13:24:59.000Z
CVE-2020-11875 
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10.0 (MTK chipsets) software. The MTK kernel does not properly implement exception handling, allowing an attacker to gain privileges. The LG ID is LVE-SMP-200001 (February 2020).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T13:26:02.000Z
CVE-2020-11876 
airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE: the vendor states that this initialization only occurs within unreachable code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T15:46:01.000Z
CVE-2020-11877 
airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC encryption. NOTE: the vendor states that this IV is used only within unreachable code
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T15:45:43.000Z
CVE-2020-11878 
The Jitsi Meet (aka docker-jitsi-meet) stack on Docker before stable-4384-1 uses default passwords (such as passw0rd) for system accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T15:57:33.000Z
CVE-2020-11879 
An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T17:07:41.000Z
CVE-2020-11880 
An issue was discovered in KDE KMail before 19.12.3. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make KMail attach local files to a composed email message without showing a warning to the user, as demonstrated by an attach=.bash_history value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T17:07:26.000Z
CVE-2020-11881 
An array index error in MikroTik RouterOS 6.41.3 through 6.46.5, and 7.x through 7.0 Beta5, allows an unauthenticated remote attacker to crash the SMB server via modified setup-request packets, aka SUP-12964.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-14T20:06:38.000Z
CVE-2020-11882 
The O2 Business application 1.2.0 for Android exposes the canvasm.myo2.SplashActivity activity to other applications. The purpose of this activity is to handle deeplinks that can be delivered either via links or by directly calling the activity. However, the deeplink format is not properly validated. This can be abused by an attacker to redirect a user to any page and deliver any content to the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-07T15:39:00.000Z
CVE-2020-11883 
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T18:39:11.000Z
CVE-2020-11884 
In the Linux kernel 4.19 through 5.6.7 on the s390 platform, code execution may occur because of a race condition, as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade, aka CID-3f777e19d171. A crash could also occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T12:07:37.000Z
CVE-2020-11885 
WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T19:14:03.000Z
CVE-2020-11886 
OpenNMS Horizon and Meridian allows HQL Injection in element/nodeList.htm (aka the NodeListController) via snmpParm or snmpParmValue to addCriteriaForSnmpParm. This affects Horizon before 25.2.1, Meridian 2019 before 2019.1.4, Meridian 2018 before 2018.1.16, and Meridian 2017 before 2017.1.21.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T19:37:49.000Z
CVE-2020-11887 
svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-17T20:08:39.000Z
CVE-2020-11888 
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-20T15:48:13.000Z
CVE-2020-11889 
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized deletion of usergroups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T16:39:09.000Z
CVE-2020-11890 
An issue was discovered in Joomla! before 3.9.17. Improper input validations in the usergroup table class could lead to a broken ACL configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T16:38:23.000Z
CVE-2020-11891 
An issue was discovered in Joomla! before 3.9.17. Incorrect ACL checks in the access level section of com_users allow the unauthorized editing of usergroups.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-21T16:40:04.000Z
CVE-2020-11894 
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (8 bytes) in the function decompileIF() in decompile.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-19T18:04:45.000Z
CVE-2020-11895 
Ming (aka libming) 0.4.8 has a heap-based buffer over-read (2 bytes) in the function decompileIF() in decompile.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-19T18:04:35.000Z
CVE-2020-11896 
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:21:31.000Z
CVE-2020-11897 
The Treck TCP/IP stack before 5.0.1.35 has an Out-of-Bounds Write via multiple malformed IPv6 packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:23:22.000Z
CVE-2020-11898 
The Treck TCP/IP stack before 6.0.1.66 improperly handles an IPv4/ICMPv4 Length Parameter Inconsistency, which might allow remote attackers to trigger an information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:26:18.000Z
CVE-2020-11899 
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:27:59.000Z
CVE-2020-11900 
The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:30:24.000Z
CVE-2020-11901 
The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:34:01.000Z
CVE-2020-11902 
The Treck TCP/IP stack before 6.0.1.66 has an IPv6OverIPv4 tunneling Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:36:19.000Z
CVE-2020-11903 
The Treck TCP/IP stack before 6.0.1.28 has a DHCP Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:37:56.000Z
CVE-2020-11904 
The Treck TCP/IP stack before 6.0.1.66 has an Integer Overflow during Memory Allocation that causes an Out-of-Bounds Write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:41:12.000Z
CVE-2020-11905 
The Treck TCP/IP stack before 6.0.1.66 has a DHCPv6 Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:43:14.000Z
CVE-2020-11906 
The Treck TCP/IP stack before 6.0.1.66 has an Ethernet Link Layer Integer Underflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:44:58.000Z
CVE-2020-11907 
The Treck TCP/IP stack before 6.0.1.66 improperly handles a Length Parameter Inconsistency in TCP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:47:17.000Z
CVE-2020-11908 
The Treck TCP/IP stack before 4.7.1.27 mishandles '\0' termination in DHCP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:49:17.000Z
CVE-2020-11909 
The Treck TCP/IP stack before 6.0.1.66 has an IPv4 Integer Underflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:51:09.000Z
CVE-2020-11910 
The Treck TCP/IP stack before 6.0.1.66 has an ICMPv4 Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:52:48.000Z
CVE-2020-11911 
The Treck TCP/IP stack before 6.0.1.66 has Improper ICMPv4 Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:55:05.000Z
CVE-2020-11912 
The Treck TCP/IP stack before 6.0.1.66 has a TCP Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:56:38.000Z
CVE-2020-11913 
The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:58:24.000Z
CVE-2020-11914 
The Treck TCP/IP stack before 6.0.1.66 has an ARP Out-of-bounds Read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-17T10:59:51.000Z
CVE-2020-11915 
An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. By sending a set_params.cgi?telnetd=1&save=1&reboot=1 request to the webserver, it is possible to enable the telnet interface on the device. The telnet interface can then be used to obtain access to the device with root privileges via a reecam4debug default password. This default telnet password is the same across all Siime Eye devices. In order for the attack to be exploited, an attacker must be physically close in order to connect to the device's Wi-Fi access point.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-08T01:40:45.000Z
CVE-2020-11916 
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. The password for the root user is hashed using an old and deprecated hashing technique. Because of this deprecated hashing, the success probability of an attacker in an offline cracking attack is greatly increased.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2020-11917 
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. It uses a default SSID value, which makes it easier for remote attackers to discover the physical locations of many Siime Eye devices, violating the privacy of users who do not wish to disclose their ownership of this type of device. (Various resources such as wigle.net can be use for mapping of SSIDs to physical locations.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2020-11918 
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on all users, including passwords, can be found in cleartext in the backup file. An attacker capable of accessing the web interface can create the backup file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z