rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-7971 
GitLab EE 11.0 and later through 12.7.2 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:54:27.000Z
CVE-2020-7972 
GitLab EE 12.2 has Insecure Permissions (issue 2 of 2).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:53:22.000Z
CVE-2020-7973 
GitLab through 12.7.2 allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:52:09.000Z
CVE-2020-7974 
GitLab EE 10.1 through 12.7.2 allows Information Disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:51:08.000Z
CVE-2020-7976 
GitLab EE 12.4 and later through 12.7.2 has Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:26:53.000Z
CVE-2020-7977 
GitLab EE 8.8 and later through 12.7.2 has Insecure Permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:25:36.000Z
CVE-2020-7978 
GitLab EE 12.6 and later through 12.7.2 allows Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T15:20:57.000Z
CVE-2020-7979 
GitLab EE 8.9 and later through 12.7.2 has Insecure Permission
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T14:47:29.000Z
CVE-2020-7980 
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-25T18:44:51.000Z
CVE-2020-7981 
sql.rb in Geocoder before 1.6.1 allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-25T19:18:35.000Z
CVE-2020-7982 
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index, allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-16T21:05:49.000Z
CVE-2020-7983 
A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-05T17:06:51.000Z
CVE-2020-7984 
SolarWinds N-central before 12.1 SP1 HF5 and 12.2 before SP1 HF2 allows remote attackers to retrieve cleartext domain admin credentials from the Agent & Probe settings, and obtain other sensitive information. The attacker can use a customer ID to self register and read any aspects of the agent/appliance configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-26T20:04:06.000Z
CVE-2020-7988 
An issue was discovered in tools/pass-change/result.php in phpIPAM 1.4. CSRF can be used to change the password of any user/admin, to escalate privileges, and to gain access to more data and functionality. This issue exists due to the lack of a requirement to provide the old password, and the lack of security tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-04T16:07:52.000Z
CVE-2020-7989 
Adive Framework 2.0.8 has admin/user/add userUsername XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-26T21:23:08.000Z
CVE-2020-7990 
Adive Framework 2.0.8 has admin/user/add userName XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-26T21:22:58.000Z
CVE-2020-7991 
Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-26T21:22:48.000Z
CVE-2020-7993 
Prototype 1.6.0.1 allows remote authenticated users to forge ticket creation (on behalf of other user accounts) via a modified email ID field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-03T14:26:38.000Z
CVE-2020-7994 
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-26T22:44:29.000Z
CVE-2020-7995 
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-26T22:44:16.000Z
CVE-2020-7996 
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-26T22:44:02.000Z
CVE-2020-7997 
ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T04:33:24.000Z
CVE-2020-7998 
An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path that is accessible and hidden next to the root path. By default, there is no password set for the FTP or Web UI service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-28T04:36:52.000Z
CVE-2020-7999 
The Intellian Aptus application 1.0.2 for Android has hardcoded values for DOWNLOAD_API_KEY and FILE_DOWNLOAD_API_KEY.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T00:36:56.000Z
CVE-2020-8000 
Intellian Aptus Web 1.24 has a hardcoded password of 12345678 for the intellian account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T00:37:15.000Z
CVE-2020-8001 
The Intellian Aptus application 1.0.2 for Android has a hardcoded password of intellian for the masteruser FTP account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T00:37:06.000Z
CVE-2020-8002 
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch a grid without previously providing a Compute Shader (CS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T00:00:00.000Z
CVE-2020-8003 
A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation failure, because vrend_renderer_resource_allocated_texture is not an appropriate place for a free.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T00:00:00.000Z
CVE-2020-8004 
STMicroelectronics STM32F1 devices have Incorrect Access Control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-06T12:44:31.000Z
CVE-2020-8006 
The server in Circontrol Raption through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The ocpp1.5 and pwrstudio binaries on the charging station do not use a number of common exploitation mitigations. In particular, there are no stack canaries and they do not use the Position Independent Executable (PIE) format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-12T00:00:00.000Z
CVE-2020-8007 
The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-08T00:00:00.000Z
CVE-2020-8009 
AVB MOTU devices through 2020-01-22 allow /.. Directory Traversal, as demonstrated by reading the /etc/passwd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-27T13:33:14.000Z
CVE-2020-8010 
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot (controller) component. A remote attacker can execute commands, read from, or write to the target system.
Problem types: description: improper ACL handling RCE
Affected products: vendor: CA Technologies - A Broadcom Company
product: CA Unified Infrastructure Management (Nimsoft/UIM)
Published: 2020-02-18T03:11:43.000Z
CVE-2020-8011 
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a null pointer dereference vulnerability in the robot (controller) component. A remote attacker can crash the Controller service.
Problem types: description: null pointer dereference DoS
Affected products: vendor: CA Technologies - A Broadcom Company
product: CA Unified Infrastructure Management (Nimsoft/UIM)
Published: 2020-02-18T03:11:32.000Z
CVE-2020-8012 
CA Unified Infrastructure Management (Nimsoft/UIM) 20.1, 20.3.x, and 9.20 and below contains a buffer overflow vulnerability in the robot (controller) component. A remote attacker can execute arbitrary code.
Problem types: description: buffer overflow RCE
Affected products: vendor: CA Technologies - A Broadcom Company
product: CA Unified Infrastructure Management (Nimsoft/UIM)
Published: 2020-02-18T03:12:16.000Z
CVE-2020-8013 permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim
A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 12
vendor: SUSE
product: SUSE Linux Enterprise Server 15
vendor: SUSE
product: SUSE Linux Enterprise Server 11
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2020-03-02T16:35:13.188Z
CVE-2020-8014 kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackage
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with the privileges of the kopano user to escalate to root. This issue affects: openSUSE Leap 15.1 kopano-spamd versions prior to 10.0.5-lp151.4.1. openSUSE Tumbleweed kopano-spamd versions prior to 10.0.5-1.1.
Problem types: cwe_id: CWE-61
description: CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: openSUSE
product: openSUSE Leap 15.1
vendor: openSUSE
product: openSUSE Tumbleweed
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2020-06-29T12:00:23.054Z
CVE-2020-8015 Local privilege escalation in exim package from user mail to root
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.
Problem types: cwe_id: CWE-59
description: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: openSUSE
product: Factory
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2020-04-02T07:55:13.216Z
CVE-2020-8016 race condition in the packaging of texlive-filesysten
A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Module for Desktop Applications 15-SP1
vendor: SUSE
product: SUSE Linux Enterprise Software Development Kit 12-SP4
vendor: SUSE
product: SUSE Linux Enterprise Software Development Kit 12-SP5
vendor: openSUSE
product: openSUSE Leap 15.1
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
baseScore: 4.9
baseSeverity: MEDIUM
Credits: lang: en
value: Matthias Gerstner of SUSE
Published: 2020-04-02T14:05:17.952Z
CVE-2020-8017 race condition on texlive-filesystem cron job allows for the deletion of unintended files
A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.
Problem types: cwe_id: CWE-367
description: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Module for Desktop Applications 15-SP1
vendor: SUSE
product: SUSE Linux Enterprise Software Development Kit 12-SP4
vendor: SUSE
product: SUSE Linux Enterprise Software Development Kit 12-SP5
vendor: openSUSE
product: openSUSE Leap 15.1
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
Credits: lang: en
value: Matthias Gerstner of SUSE
Published: 2020-04-02T14:05:18.643Z
CVE-2020-8018 User owned /etc in SLES15-SP1-CHOST-BYOS
A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 allows local attackers with the UID 1000 to escalate to root due to a /etc directory owned by the user This issue affects: SUSE Linux Enterprise Server 15 SP1 SLES15-SP1-CAP-Deployment-BYOS version 1.0.1 and prior versions; SLES15-SP1-CHOST-BYOS versions prior to 1.0.3 and prior versions;
Problem types: cwe_id: CWE-276
description: CWE-276: Incorrect Default Permissions
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP1
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP1
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-05-04T11:35:12.257Z
CVE-2020-8019 syslog-ng: Local privilege escalation from new to root in %post
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of syslog-ng of SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Module for Legacy Software 12, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server for SAP 12-SP1; openSUSE Backports SLE-15-SP1, openSUSE Leap 15.1 allowed local attackers controlling the user news to escalate their privileges to root. This issue affects: SUSE Linux Enterprise Debuginfo 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Debuginfo 11-SP4 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Module for Legacy Software 12 syslog-ng versions prior to 3.6.4-12.8.1. SUSE Linux Enterprise Point of Sale 11-SP3 syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server 11-SP4-LTSS syslog-ng versions prior to 2.0.9-27.34.40.5.1. SUSE Linux Enterprise Server for SAP 12-SP1 syslog-ng versions prior to 3.6.4-12.8.1. openSUSE Backports SLE-15-SP1 syslog-ng versions prior to 3.19.1-bp151.4.6.1. openSUSE Leap 15.1 syslog-ng versions prior to 3.19.1-lp151.3.6.1.
Problem types: cwe_id: CWE-61
description: CWE-61: UNIX Symbolic Link (Symlink) Following
Affected products: vendor: SUSE
product: SUSE Linux Enterprise Debuginfo 11-SP3
vendor: SUSE
product: SUSE Linux Enterprise Debuginfo 11-SP4
vendor: SUSE
product: SUSE Linux Enterprise Module for Legacy Software 12
vendor: SUSE
product: SUSE Linux Enterprise Point of Sale 11-SP3
vendor: SUSE
product: SUSE Linux Enterprise Server 11-SP4-LTSS
vendor: SUSE
product: SUSE Linux Enterprise Server for SAP 12-SP1
vendor: openSUSE
product: openSUSE Backports SLE-15-SP1
vendor: openSUSE
product: openSUSE Leap 15.1
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Johannes Segitz of SUSE
Published: 2020-06-29T11:30:14.396Z
CVE-2020-8020 Persistent XSS in markdown parser used by obs-server
A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation
Affected products: vendor: openSUSE
product: open-build-service
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Victor Pereira of SUSE
Published: 2020-05-13T14:50:13.224Z
CVE-2020-8021 unauthorized read access to files where sourceaccess is disabled via a crafted _service file in Open Build Service
a Improper Access Control vulnerability in of Open Build Service allows remote attackers to read files of an OBS package where the sourceaccess/access is disabled This issue affects: Open Build Service versions prior to 2.10.5.
Problem types: cwe_id: CWE-269
description: CWE-269: Improper Privilege Management
Affected products: vendor: openSUSE
product: Open Build Service
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Marcus Hüwe
Published: 2020-05-19T14:25:18.710Z