rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-14456 
An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:12:30.000Z
CVE-2020-14457 
An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the update_team WebSocket event, aka MMSA-2020-0012.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:13:32.000Z
CVE-2020-14458 
An issue was discovered in Mattermost Server before 5.19.0. Attackers can discover private channels via the "get channel by name" API, aka MMSA-2020-0004.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:14:22.000Z
CVE-2020-14459 
An issue was discovered in Mattermost Server before 5.19.0. Attackers can rename a channel and cause a collision with a direct message, aka MMSA-2020-0002.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:15:13.000Z
CVE-2020-14460 
An issue was discovered in Mattermost Server before 5.19.0, 5.18.1, 5.17.3, 5.16.5, and 5.9.8. Creation of a trusted OAuth application does not always require admin privileges, aka MMSA-2020-0001.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T13:16:12.000Z
CVE-2020-14461 
Zyxel Armor X1 WAP6806 1.00(ABAL.6)C0 devices allow Directory Traversal via the images/eaZy/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-22T12:39:57.000Z
CVE-2020-14462 
CALDERA 2.7.0 allows XSS via the Operation Name box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T11:34:36.000Z
CVE-2020-14470 
In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T14:48:32.000Z
CVE-2020-14472 
On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T16:51:23.000Z
CVE-2020-14473 
Stack-based buffer overflow vulnerability in Vigor3900, Vigor2960, and Vigor300B with firmware before 1.5.1.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-24T16:41:51.000Z
CVE-2020-14474 
The Cellebrite UFED physical device 5.0 through 7.5.0.845 relies on key material hardcoded within both the executable code supporting the decryption process, and within the encrypted files themselves by using a key enveloping technique. The recovered key material is the same for every device running the same version of the software, and does not appear to be changed with each new build. It is possible to reconstruct the decryption process using the hardcoded key material and obtain easy access to otherwise protected data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T18:03:50.000Z
CVE-2020-14475 
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T16:20:00.000Z
CVE-2020-14477 Philips Ultrasound Systems Authentication Bypass Using an Alternate Path or Channel
In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sparq Version 3.0.2 and prior and Ultrasound Xperius all versions, an attacker may use an alternate path or channel that does not require authentication of the alternate service login to view or modify information.
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: Philips
product: Ultrasound ClearVue
default_status: unaffected
vendor: Philips
product: Ultrasound CX
default_status: unaffected
vendor: Philips
product: Ultrasound EPIQ/Affiniti
default_status: unaffected
vendor: Philips
product: Ultrasound Sparq
default_status: unaffected
vendor: Philips
product: Ultrasound Xperius
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.6
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Philips reported this vulnerability to CISA.
Published: 2020-06-26T16:15:14.000Z
CVE-2020-14478 IMPROPER RESTRICTION OF XML EXTERNAL ENTITY REFERENCE CWE-611
A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A successful exploit could potentially cause a denial-of-service condition and allow the attacker to arbitrarily read any local file via system-level services.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
Affected products: vendor: Rockwell Automation
product: FactoryTalk Services Platform
Published: 2022-02-24T18:27:13.156Z
CVE-2020-14479 ICSA-20-147-01 Inductive Automation Ignition (Update B)
Sensitive information can be obtained through the handling of serialized data. The issue results from the lack of proper authentication required to query the server
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: Inductive Automation
product: Ignition 7 Gateway
vendor: Inductive Automation
product: Ignition 8 Gateway
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Pedro Ribeiro, Radek Domanski, Chris Anastasio (muffin), and Steven Seeley (mr_me) working with Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Published: 2022-04-01T22:17:52.198Z
CVE-2020-14480 
Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to certain credentials, including Windows Logon credentials.
Problem types: cwe_id: CWE-312
description: CWE-312
Affected products: vendor: Rockwell Automation
product: FactoryTalk View SE
Published: 2022-02-24T18:27:14.889Z
CVE-2020-14481 
The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credentials, including the Windows user or Windows DeskLock passwords. If the compromised user has an administrative account, an attacker could gain full access to the user’s operating system and certain components of FactoryTalk View SE.
Problem types: cwe_id: CWE-261
description: CWE-261 Weak Cryptography for Passwords
Affected products: vendor: Rockwell Automation
product: FactoryTalk View SE
Published: 2022-02-24T18:27:13.935Z
CVE-2020-14482 
Delta Industrial Automation DOPSoft, Version 4.00.08.15 and prior. Opening a specially crafted project file may overflow the heap, which may allow remote code execution, disclosure/modification of information, or cause the application to crash.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: n/a
product: Delta Industrial Automation DOPSoft
Published: 2020-06-30T17:43:23.000Z
CVE-2020-14483 
A timeout during a TLS handshake can result in the connection failing to terminate. This can result in a Niagara thread hanging and requires a manual restart of Niagara (Versions 4.6.96.28, 4.7.109.20, 4.7.110.32, 4.8.0.110) and Niagara Enterprise Security (Versions 2.4.31, 2.4.45, 4.8.0.35) to correct.
Problem types: cwe_id: CWE-1088
description: SYNCHRONOUS ACCESS OF REMOTE RESOURCE WITHOUT TIMEOUT CWE-1088
Affected products: vendor: n/a
product: Niagara
Published: 2020-08-13T14:41:35.000Z
CVE-2020-14484 
OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks.
Problem types: cwe_id: CWE-307
description: IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2020-07-20T14:45:20.000Z
CVE-2020-14485 
OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries.
Problem types: cwe_id: CWE-288
description: AUTHENTICATION BYPASS USING AN ALTERNATE PATH OR CHANNEL CWE-288
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2020-07-20T14:45:10.000Z
CVE-2020-14486 OpenClinic GA
An attacker may bypass permission/authorization checks in OpenClinic GA 5.09.02 and 5.89.05b by ignoring the redirect of a permission failure, which may allow unauthorized execution of commands.
Problem types: cwe_id: CWE-285
description: IMPROPER AUTHORIZATION CWE-285
Affected products: vendor: open source
product: OpenClinic GA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Brian D. Hysell reported these vulnerabilities to CISA.
Published: 2020-07-29T13:21:03.686Z
CVE-2020-14487 OpenClinic GA
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands.
Problem types: cwe_id: CWE-912
description: HIDDEN FUNCTIONALITY CWE-912
Affected products: vendor: open source
product: OpenClinic GA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 9.4
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
version: 3.1
Credits: lang: en
value: Brian D. Hysell reported these vulnerabilities to CISA.
Published: 2020-07-29T13:22:25.067Z
CVE-2020-14488 OpenClinic GA
OpenClinic GA 5.09.02 and 5.89.05b does not properly verify uploaded files, which may allow a low-privilege user to upload and execute arbitrary files on the system.
Problem types: cwe_id: CWE-434
description: UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
Affected products: vendor: open source
product: OpenClinic GA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Brian D. Hysell reported these vulnerabilities to CISA.
Published: 2020-07-29T13:15:21.912Z
CVE-2020-14489 OpenClinic GA
OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques.
Problem types: cwe_id: CWE-522
description: INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522
Affected products: vendor: open source
product: OpenClinic GA
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Brian D. Hysell reported these vulnerabilities to CISA.
Published: 2020-07-29T12:24:11.103Z
CVE-2020-14490 OpenClinic GA
OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow disclosure of sensitive files or the execution of malicious uploaded files.
Problem types: cwe_id: CWE-22
description: IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
Affected products: vendor: open source
product: OpenClinic GA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Brian D. Hysell reported these vulnerabilities to CISA.
Published: 2020-07-29T12:25:53.168Z
CVE-2020-14491 
OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access privileged information.
Problem types: cwe_id: CWE-862
description: MISSING AUTHORIZATION CWE-862
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2020-07-20T14:45:36.000Z
CVE-2020-14492 OpenClinic GA
OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code within the user’s browser.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: open source
product: OpenClinic GA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Brian D. Hysell reported these vulnerabilities to CISA.
Published: 2020-07-29T12:29:11.124Z
CVE-2020-14493 OpenClinic GA
A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands.
Problem types: cwe_id: CWE-250
description: EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
Affected products: vendor: open source
product: OpenClinic GA
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Brian D. Hysell reported these vulnerabilities to CISA.
Published: 2020-07-29T12:27:28.691Z
CVE-2020-14494 
OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts.
Problem types: cwe_id: CWE-287
description: IMPROPER AUTHENTICATION CWE-287
Affected products: vendor: n/a
product: OpenClinic GA
Published: 2020-07-20T14:45:28.000Z
CVE-2020-14496 Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues
Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.
Problem types: cwe_id: CWE-275
description: CWE-275 Permission Issues
Affected products: vendor: Mitsubishi Electric
product: CPU Module Logging Configuration Tool
vendor: Mitsubishi Electric
product: CW Configurator
vendor: Mitsubishi Electric
product: Data Transfer
vendor: Mitsubishi Electric
product: EZSocket
vendor: Mitsubishi Electric
product: FR Configurator2
vendor: Mitsubishi Electric
product: GT Designer3 Version1 (GOT2000)
vendor: Mitsubishi Electric
product: GT SoftGOT1000 Version3
vendor: Mitsubishi Electric
product: GT SoftGOT1000 Version3
vendor: Mitsubishi Electric
product: GT SoftGOT2000 Version1
vendor: Mitsubishi Electric
product: GX LogViewer
vendor: Mitsubishi Electric
product: GX Works2
vendor: Mitsubishi Electric
product: GX Works3
vendor: Mitsubishi Electric
product: M_CommDTM-HART
vendor: Mitsubishi Electric
product: M_CommDTM-IO-Link
vendor: Mitsubishi Electric
product: MELFA-Works
vendor: Mitsubishi Electric
product: MELSEC WinCPU Setting Utility
vendor: Mitsubishi Electric
product: MELSOFT EM Software Development Kit (EM Configurator)
vendor: Mitsubishi Electric
product: MELSOFT FieldDeviceConfigurator
vendor: Mitsubishi Electric
product: MELSOFT Navigator
vendor: Mitsubishi Electric
product: MH11 SettingTool Version2
vendor: Mitsubishi Electric
product: MI Configurator
vendor: Mitsubishi Electric
product: Motorizer
vendor: Mitsubishi Electric
product: MR Configurator2
vendor: Mitsubishi Electric
product: MT Works2
vendor: Mitsubishi Electric
product: MX Component
vendor: Mitsubishi Electric
product: Network Interface Board CC IE Control utility
vendor: Mitsubishi Electric
product: Network Interface Board CC IE Field Utility
vendor: Mitsubishi Electric
product: Network Interface Board CC-Link Ver.2 Utility
vendor: Mitsubishi Electric
product: Network Interface Board MNETH utility
vendor: Mitsubishi Electric
product: PX Developer
vendor: Mitsubishi Electric
product: RT ToolBox2
vendor: Mitsubishi Electric
product: RT ToolBox3
vendor: Mitsubishi Electric
product: Setting/monitoring tools for the C Controller module
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2022-05-19T17:24:43.000Z
CVE-2020-14497 
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
Problem types: cwe_id: CWE-89
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
Affected products: vendor: n/a
product: Advantech iView
Published: 2020-07-15T01:50:54.000Z
CVE-2020-14498 HMS Industrial Networks AB eCatcher Stack-based Buffer Overflow
HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: HMS Industrial Networks AB
product: eCatcher
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sharon Brizinov of Claroty reported this vulnerability to CISA.
Published: 2020-08-26T13:30:01.000Z
CVE-2020-14499 
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: n/a
product: Advantech iView
Published: 2020-07-15T02:11:10.000Z
CVE-2020-14500 IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158
Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.
Problem types: cwe_id: CWE-158
description: IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-158
Affected products: vendor: Secomea GateManager all versions prior to 9.2c
product: Secomea GateManager all versions prior to 9.2c
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-08-25T13:12:30.705Z
CVE-2020-14501 
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also delete the administrator account.
Problem types: cwe_id: CWE-306
description: MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306
Affected products: vendor: n/a
product: Advantech iView
Published: 2020-07-15T02:19:48.000Z
CVE-2020-14502 
The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicious script within the web interface that, when executed, could modify some string values on the homepage of the web interface.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Rockwell Automation
product: 1734-AENTR
Published: 2022-02-24T18:26:57.475Z
CVE-2020-14503 
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-20
description: IMPROPER INPUT VALIDATION CWE-20
Affected products: vendor: n/a
product: Advantech iView
Published: 2020-07-15T02:15:13.000Z
CVE-2020-14504 
The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attacker can send a crafted request that may allow for modification of the configuration settings.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Rockwell Automation
product: 1734-AENTR
Published: 2022-02-24T18:26:56.514Z
CVE-2020-14505 
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any validation. The attacker may then remotely execute code.
Problem types: cwe_id: CWE-77
description: IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND ('COMMAND INJECTION') CWE-77
Affected products: vendor: n/a
product: Advantech iView
Published: 2020-07-15T01:59:33.000Z