rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-6966 
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.
Problem types: cwe_id: CWE-326
description: INADEQUATE ENCRYPTION STRENGTH CWE-326
Affected products: vendor: n/a
product: GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors
Published: 2020-01-24T17:07:00.000Z
CVE-2020-6967 
In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data.
Problem types: cwe_id: CWE-502
description: DESERIALIZATION OF UNTRUSTED DATA CWE-502
Affected products: vendor: n/a
product: Rockwell Automation All versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform
Published: 2020-03-23T20:16:11.000Z
CVE-2020-6968 
Honeywell INNCOM INNControl 3 allows workstation users to escalate application user privileges through the modification of local configuration files.
Problem types: cwe_id: CWE-269
description: IMPROPER PRIVILEGE MANAGEMENT CWE-269
Affected products: vendor: Honeywell
product: INNCOM INNControl 3
Published: 2020-02-20T20:50:43.000Z
CVE-2020-6969 
It is possible to unmask credentials and other sensitive information on “unprotected” project files, which may allow an attacker to remotely access the C-More Touch Panels EA9 series: firmware versions prior to 6.53 and manipulate system configurations.
Problem types: cwe_id: CWE-522
description: INSUFFICIENTLY PROTECTED CREDENTIALS (CWE-522)
Affected products: vendor: n/a
product: C-More Touch Panels EA9 series
Published: 2020-02-05T15:09:30.000Z
CVE-2020-6970 
A Heap-based Buffer Overflow was found in Emerson OpenEnterprise SCADA Server 2.83 (if Modbus or ROC Interfaces have been installed and are in use) and all versions of OpenEnterprise 3.1 through 3.3.3, where a specially crafted script could execute code on the OpenEnterprise Server.
Problem types: cwe_id: CWE-122
description: HEAP-BASED BUFFER OVERFLOW CWE-122
Affected products: vendor: Emerson
product: OpenEnterprise SCADA Server
vendor: Emerson
product: OpenEnterprise
Published: 2020-02-19T20:19:55.000Z
CVE-2020-6971 
In Emerson ValveLink v12.0.264 to v13.4.118, a vulnerability in the ValveLink software may allow a local, unprivileged, trusted insider to escalate privileges due to insecure configuration parameters.
Problem types: cwe_id: CWE-284
description: IMPROPER ACCESS CONTROL CWE-284
Affected products: vendor: n/a
product: Emerson ValveLink
Published: 2020-03-05T20:02:58.000Z
CVE-2020-6972 
In Notifier Web Server (NWS) Version 3.50 and earlier, the Honeywell Fire Web Server’s authentication may be bypassed by a capture-replay attack from a web browser.
Problem types: cwe_id: CWE-294
description: AUTHENTICATION BYPASS BY CAPTURE-REPLAY CWE-294
Affected products: vendor: Honeywell
product: Notifier Web Server (NWS) Version 3.50 and earlier
Published: 2020-03-24T16:38:57.000Z
CVE-2020-6973 
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Multiple cross-site scripting vulnerabilities exist that could allow an attacker to cause a denial-of-service condition.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: Digi International ConnectPort LTS 32 MEI
Published: 2020-02-12T23:01:19.000Z
CVE-2020-6974 
Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem.
Problem types: cwe_id: CWE-22
description: PATH TRAVERSAL CWE-22
Affected products: vendor: n/a
product: Honeywell Notifier Web Server (NWS)
Published: 2020-04-07T17:06:02.000Z
CVE-2020-6975 
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 (82002228_K 08/09/2018), bios Version 1.2. Successful exploitation of this vulnerability could allow an attacker to upload a malicious file to the application.
Problem types: cwe_id: CWE-434
description: UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-434
Affected products: vendor: n/a
product: Digi International ConnectPort LTS 32 MEI
Published: 2020-02-12T23:00:00.000Z
CVE-2020-6976 
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. An out-of-bounds read overflow can be exploited when a valid user opens a specially crafted, malicious input file due to the lack of validation.
Problem types: cwe_id: CWE-125
description: OUT-OF-BOUNDS READ CWE-125
Affected products: vendor: n/a
product: Delta Industrial Automation CNCSoft ScreenEditor
Published: 2020-03-18T13:01:23.000Z
CVE-2020-6977 
A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE Ultrasound Products: Vivid products - all versions; LOGIQ - all versions not including LOGIQ 100 Pro; Voluson - all versions; Versana Essential - all versions; Invenia ABUS Scan station - all versions; Venue - all versions not including Venue 40 R1-3 and Venue 50 R4-5
Problem types: cwe_id: CWE-693
description: PROTECTIONS MECHANISM FAILURE CWE-693
Affected products: vendor: GE
product: GE Ultrasound Products
Published: 2020-02-20T20:45:29.000Z
CVE-2020-6978 
In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries.
Problem types: cwe_id: CWE-477
description: USE OF OBSOLETE FUNCTION CWE-477
Affected products: vendor: n/a
product: Honeywell WIN-PAK 4.7.2, Web and prior versions
Published: 2020-03-24T20:09:17.000Z
CVE-2020-6979 
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential data can be recovered.
Problem types: cwe_id: CWE-321
description: USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321
Affected products: vendor: n/a
product: Moxa EDS-G516E Series firmware, Version 5.2 or lower
Published: 2020-03-24T20:21:41.000Z
CVE-2020-6980 
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol (SMTP) account data is saved in RSLogix 500, a local attacker with access to a victim’s project may be able to gather SMTP server authentication data as it is written to the project file in cleartext.
Problem types: cwe_id: CWE-312
description: CLEARTEXT STORAGE OF SENSITIVE INFORMATION CWE-312
Affected products: vendor: n/a
product: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior
Published: 2020-03-16T15:36:51.000Z
CVE-2020-6981 
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: Moxa EDS-G516E Series firmware, Version 5.2 or lower
Published: 2020-03-24T20:23:48.000Z
CVE-2020-6982 
In Honeywell WIN-PAK 4.7.2, Web and prior versions, the header injection vulnerability has been identified, which may allow remote code execution.
Problem types: cwe_id: CWE-644
description: IMPROPER NEUTRALIZATION OF HTTP HEADERS FOR SCRIPTING SYNTAX CWE-644
Affected products: vendor: n/a
product: Honeywell WIN-PAK 4.7.2, Web and prior versions
Published: 2020-03-24T20:04:38.000Z
CVE-2020-6983 
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a hard-coded cryptographic key, which increases the possibility that confidential data can be recovered.
Problem types: cwe_id: CWE-321
description: USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321
Affected products: vendor: n/a
product: Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower
Published: 2020-03-24T18:57:14.000Z
CVE-2020-6984 
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic function utilized to protect the password in MicroLogix is discoverable.
Problem types: cwe_id: CWE-327
description: USE OF A BROKEN OR RISKY ALGORITHM FOR PASSWORD PROTECTION USE OF CLIENT-SIDE AUTHENTICATION CWE-327
Affected products: vendor: n/a
product: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior
Published: 2020-03-16T15:41:13.000Z
CVE-2020-6985 
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console.
Problem types: cwe_id: CWE-798
description: USE OF HARD-CODED CREDENTIALS CWE-798
Affected products: vendor: n/a
product: Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower
Published: 2020-03-24T19:11:40.000Z
CVE-2020-6986 
In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service error on the PLC Ethernet module, which in turn causes a PLC service denied result.
Problem types: cwe_id: CWE-400
description: UNCONTROLLED RESOURCE CONSUMPTION CWE-400
Affected products: vendor: n/a
product: Omron PLC CJ Series
Published: 2020-03-05T20:05:05.000Z
CVE-2020-6987 
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to be disclosed.
Problem types: cwe_id: CWE-327
description: USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327
Affected products: vendor: n/a
product: Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower
Published: 2020-03-24T19:00:16.000Z
CVE-2020-6988 
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, A remote, unauthenticated attacker can send a request from the RSLogix 500 software to the victim’s MicroLogix controller. The controller will then respond to the client with used password values to authenticate the user on the client-side. This method of authentication may allow an attacker to bypass authentication altogether, disclose sensitive information, or leak credentials.
Problem types: cwe_id: CWE-603
description: USE OF CLIENT-SIDE AUTHENTICATION CWE-603
Affected products: vendor: n/a
product: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior
Published: 2020-03-16T15:38:36.000Z
CVE-2020-6989 
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, a buffer overflow in the web server allows remote attackers to cause a denial-of-service condition or execute arbitrary code.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower
Published: 2020-03-24T18:54:19.000Z
CVE-2020-6990 
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. An attacker could identify cryptographic keys and use it for further cryptographic attacks that could ultimately lead to a remote attacker gaining unauthorized access to the controller.
Problem types: cwe_id: CWE-321
description: USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321
Affected products: vendor: n/a
product: Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior
Published: 2020-03-16T15:39:45.000Z
CVE-2020-6991 
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, weak password requirements may allow an attacker to gain access using brute force.
Problem types: cwe_id: CWE-521
description: WEAK PASSWORD REQUIREMENTS CWE-521
Affected products: vendor: n/a
product: Moxa EDS-G516E Series firmware, Version 5.2 or lower
Published: 2020-03-24T20:29:40.000Z
CVE-2020-6992 
A local privilege escalation vulnerability has been identified in the GE Digital CIMPLICITY HMI/SCADA product v10.0 and prior. If exploited, this vulnerability could allow an adversary to modify the system, leading to the arbitrary execution of code. This vulnerability is only exploitable if an attacker has access to an authenticated session. GE Digital CIMPLICITY v11.0, released January 2020, contains mitigation for this local privilege escalation vulnerability. GE Digital recommends all users upgrade to GE CIMPLICITY v11.0 or newer.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management CWE-269
Affected products: vendor: n/a
product: GE Digital CIMPLICITY
Published: 2020-04-15T16:39:49.000Z
CVE-2020-6993 
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, an attacker can gain access to sensitive information from the web service without authorization.
Problem types: cwe_id: CWE-200
description: INFORMATION EXPOSURE CWE-200
Affected products: vendor: n/a
product: Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower
Published: 2020-03-24T19:19:09.000Z
CVE-2020-6994 
A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30.
Problem types: cwe_id: CWE-12
description: BUFFER COPY WITHOUT CHECKING SIZE OF INPUT ('CLASSIC BUFFER OVERFLOW') CWE-12
Affected products: vendor: Hirschmann Automation and Control GmbH, a division of Belden Inc.
product: HiOS for the following devices RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED
vendor: Hirschmann Automation and Control GmbH, a division of Belden Inc.
product: HiSecOS for device EAGLE20/30
Published: 2020-04-03T18:04:59.000Z
CVE-2020-6995 
In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak password requirements, which may allow an attacker to gain unauthorized access.
Problem types: cwe_id: CWE-521
description: WEAK PASSWORD REQUIREMENTS CWE-521
Affected products: vendor: n/a
product: Moxa PT-7528 series firmware, Version 4.0 or lower, PT-7828 series firmware, Version 3.9 or lower
Published: 2020-03-24T19:16:16.000Z
CVE-2020-6996 
Triangle MicroWorks DNP3 Outstation LibrariesDNP3 Outstation .NET Protocol components and DNP3 Outstation ANSI C source code libraries are affected:3.16.00 through 3.25.01. A specially crafted message may cause a stack-based buffer overflow. Authentication is not required to exploit this vulnerability.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Triangle MicroWorks DNP3 Outstation LibrariesDNP3 Outstation .NET Protocol components and DNP3 Outstation ANSI C source code libraries are affected:3.16.00 through 3.25.01
Published: 2020-04-15T18:46:30.000Z
CVE-2020-6997 
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, sensitive information is transmitted over some web applications in cleartext.
Problem types: cwe_id: CWE-319
description: CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Affected products: vendor: n/a
product: Moxa EDS-G516E Series firmware, Version 5.2 or lower
Published: 2020-03-24T20:31:59.000Z
CVE-2020-6998 Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers Improper Input Validation
The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products.
Problem types: description: CVE-22 Improper Input Validation
Affected products: vendor: Rockwell Automation
product: Armor Compact GuardLogix 5370 controllers
vendor: Rockwell Automation
product: Armor GuardLogix Safety Controllers
vendor: Rockwell Automation
product: CompactLogix 5370 L1 controllers
vendor: Rockwell Automation
product: CompactLogix 5370 L2 controllers
vendor: Rockwell Automation
product: CompactLogix 5370 L3 controllers
vendor: Rockwell Automation
product: Compact GuardLogix 5370 controllers
vendor: Rockwell Automation
product: ControlLogix 5570 controllers
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Yeop Chang reported this vulnerability to CISA.
Published: 2022-07-27T20:18:00.000Z
CVE-2020-6999 
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size for its buffer.
Problem types: cwe_id: CWE-120
description: CLASSIC BUFFER OVERFLOW CWE-120
Affected products: vendor: n/a
product: Moxa EDS-G516E Series firmware, Version 5.2 or lower
Published: 2020-03-26T12:06:51.000Z
CVE-2020-7000 
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow an unauthenticated attacker to discover the cryptographic key from the web server and gain information about the login and the encryption/decryption mechanism, which may be exploited to bypass authentication of the HTML5 HMI web interface.
Problem types: cwe_id: CWE-922
description: INSECURE STORAGE OF SENSITIVE INFORMATION CWE-922
Affected products: vendor: VISAM
product: VBASE Editor
vendor: VISAM
product: VBASE Web-Remote Module
Published: 2020-04-03T17:50:58.000Z
CVE-2020-7001 
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a weak cryptographic algorithm, which may allow confidential information to be disclosed.
Problem types: cwe_id: CWE-327
description: USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327
Affected products: vendor: n/a
product: Moxa EDS-G516E Series firmware, Version 5.2 or lower
Published: 2020-03-24T20:15:15.000Z
CVE-2020-7002 
Delta Industrial Automation CNCSoft ScreenEditor, v1.00.96 and prior. Multiple stack-based buffer overflows can be exploited when a valid user opens a specially crafted, malicious input file.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Delta Industrial Automation CNCSoft ScreenEditor
Published: 2020-03-18T12:59:14.000Z
CVE-2020-7003 
In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is transmitted over some web applications in clear text.
Problem types: cwe_id: CWE-319
description: CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Affected products: vendor: n/a
product: Moxa ioLogik 2500 series firmware, Version 3.0 or lower, IOxpress configuration utility, Version 2.3.0 or lower
Published: 2020-03-24T17:02:34.000Z
CVE-2020-7004 
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow weak or insecure permissions on the VBASE directory resulting in elevation of privileges or malicious effects on the system the next time a privileged user runs the application.
Problem types: cwe_id: CWE-276
description: INCORRECT DEFAULT PERMISSIONS CWE-276
Affected products: vendor: VISAM
product: VBASE Editor
vendor: VISAM
product: VBASE Web-Remote Module
Published: 2020-04-03T17:44:24.000Z
CVE-2020-7005 
In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code.
Problem types: cwe_id: CWE-352
description: CROSS-SITE REQUEST FORGERY CWE-352
Affected products: vendor: n/a
product: Honeywell WIN-PAK 4.7.2, Web and prior versions
Published: 2020-03-24T19:55:33.000Z
CVE-2020-7006 
Systech Corporation NDS-5000 Terminal Server, NDS/5008 (8 Port, RJ45), firmware Version 02D.30. Successful exploitation of this vulnerability could allow information disclosure, limit system availability, and may allow remote code execution.
Problem types: cwe_id: CWE-79
description: IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING') CWE-79
Affected products: vendor: n/a
product: Systech Corporation NDS-5000 Terminal Server
Published: 2020-03-19T19:18:03.000Z
CVE-2020-7007 
In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the attacker may execute arbitrary codes or target the device, causing it to go out of service.
Problem types: cwe_id: CWE-121
description: STACK-BASED BUFFER OVERFLOW CWE-121
Affected products: vendor: n/a
product: Moxa EDS-G516E Series firmware, Version 5.2 or lower
Published: 2020-03-24T20:12:37.000Z
CVE-2020-7008 
VISAM VBASE Editor version 11.5.0.2 and VBASE Web-Remote Module may allow input passed in the URL that is not properly verified before use, which may allow an attacker to read arbitrary files from local resources.
Problem types: cwe_id: CWE-23
description: RELATIVE PATH TRAVERSAL CWE-23
Affected products: vendor: VISAM
product: VBASE Editor
vendor: VISAM
product: VBASE Web-Remote Module
Published: 2020-04-03T17:44:19.000Z
CVE-2020-7009 
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
Problem types: cwe_id: CWE-266
description: CWE-266: Incorrect Privilege Assignment
Affected products: vendor: Elastic
product: Elasticsearch
Published: 2020-03-31T19:05:13.000Z
CVE-2020-7010 
Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.
Problem types: cwe_id: CWE-335
description: CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
Affected products: vendor: Elastic
product: Elastic Cloud on Kubernetes
Published: 2020-06-03T17:55:42.000Z