rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-10067 Integer Overflow In is_in_region Allows User Thread To Access Kernel Memory
A malicious userspace application can cause a integer overflow and bypass security checks performed by system call handlers. The impact would depend on the underlying system call and can range from denial of service to information leak to memory corruption resulting in code execution within the kernel. See NCC-ZEP-005 This issue affects: zephyrproject-rtos zephyr version 1.14.1 and later versions. version 2.1.0 and later versions.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-05-11T22:26:17.372Z
CVE-2020-10068 Zephyr Bluetooth DLE duplicate requests vulnerability
In the Zephyr project Bluetooth subsystem, certain duplicate and back-to-back packets can cause incorrect behavior, resulting in a denial of service. This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions, and version 1.14.0 and later versions.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: PhD - Garbelini Matheus Eduardo
Published: 2020-06-05T17:37:37.415Z
CVE-2020-10069 Zephyr Bluetooth unchecked packet data results in denial of service
Zephyr Bluetooth unchecked packet data results in denial of service. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Parameters (CWE-233). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-f6vh-7v4x-8fjp
Problem types: cwe_id: CWE-233
description: Improper Handling of Parameters (CWE-233)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2021-05-24T21:40:25.468Z
CVE-2020-10070 MQTT buffer overflow on receive buffer
In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-06-05T17:37:37.459Z
CVE-2020-10071 Insufficient publish message length validation in MQTT
The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages, allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
cwe_id: CWE-129
description: CWE-129 Improper Validation of Array Index
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: NCC Group for report
Published: 2020-06-05T17:37:37.515Z
CVE-2020-10072 Improper Handling of Insufficient Permissions or Privileges  in zephyr
Improper Handling of Insufficient Permissions or Privileges in zephyr. Zephyr versions >= v1.14.2, >= v2.2.0 contain Improper Handling of Insufficient Permissions or Privileges (CWE-280). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-vf79-hqwm-w4xc
Problem types: cwe_id: CWE-280
description: Improper Handling of Insufficient Permissions or Privileges  (CWE-280)
Affected products: vendor: zephyrproject-rtos
product: zephyr
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2021-05-24T21:40:26.107Z
CVE-2020-10073 
GitLab EE 12.4.2 through 12.8.1 allows Denial of Service. It was internally discovered that a potential denial of service involving permissions checks could impact a project home page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:16:09.000Z
CVE-2020-10074 
GitLab 10.1 through 12.8.1 has Incorrect Access Control. A scenario was discovered in which a GitLab account could be taken over through an expired link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:13:49.000Z
CVE-2020-10075 
GitLab 12.5 through 12.8.1 allows HTML Injection. A particular error header was potentially susceptible to injection or potentially other vulnerabilities via unescaped input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:12:24.000Z
CVE-2020-10076 
GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:03:20.000Z
CVE-2020-10077 
GitLab EE 3.0 through 12.8.1 allows SSRF. An internal investigation revealed that a particular deprecated service was creating a server side request forgery risk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T17:01:32.000Z
CVE-2020-10078 
GitLab 12.1 through 12.8.1 allows XSS. The merge request submission form was determined to have a stored cross-site scripting vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:59:43.000Z
CVE-2020-10079 
GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:57:52.000Z
CVE-2020-10080 
GitLab 8.3 through 12.8.1 allows Information Disclosure. It was possible for certain non-members to access the Contribution Analytics page of a private group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:56:12.000Z
CVE-2020-10081 
GitLab before 12.8.2 has Incorrect Access Control. It was internally discovered that the LFS import process could potentially be used to incorrectly access LFS objects not owned by the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:54:45.000Z
CVE-2020-10082 
GitLab 12.2 through 12.8.1 allows Denial of Service. A denial of service vulnerability impacting the designs for public issues was discovered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:53:49.000Z
CVE-2020-10083 
GitLab 12.7 through 12.8.1 has Insecure Permissions. Under certain conditions involving groups, project authorization changes were not being applied.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:51:32.000Z
CVE-2020-10084 
GitLab EE 11.6 through 12.8.1 allows Information Disclosure. Sending a specially crafted request to the vulnerability_feedback endpoint could result in the exposure of a private project namespace
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:46:44.000Z
CVE-2020-10085 
GitLab 12.3.5 through 12.8.1 allows Information Disclosure. A particular view was exposing merge private merge request titles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:44:01.000Z
CVE-2020-10086 
GitLab 10.4 through 12.8.1 allows Directory Traversal. A particular endpoint was vulnerable to a directory traversal vulnerability, leading to arbitrary file read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:40:20.000Z
CVE-2020-10087 
GitLab before 12.8.2 allows Information Disclosure. Badge images were not being proxied, causing mixed content warnings as well as leaking the IP address of the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:34:34.000Z
CVE-2020-10088 
GitLab 12.5 through 12.8.1 has Insecure Permissions. Depending on particular group settings, it was possible for invited groups to be given the incorrect permission level.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:29:09.000Z
CVE-2020-10089 
GitLab 8.11 through 12.8.1 allows a Denial of Service when using several features to recursively request eachother,
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:27:29.000Z
CVE-2020-10090 
GitLab 11.7 through 12.8.1 allows Information Disclosure. Under certain group conditions, group epic information was unintentionally being disclosed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:24:55.000Z
CVE-2020-10091 
GitLab 9.3 through 12.8.1 allows XSS. A cross-site scripting vulnerability was found when viewing particular file types.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:18:51.000Z
CVE-2020-10092 
GitLab 12.1 through 12.8.1 allows XSS. A cross-site scripting vulnerability was present in a particular view relating to the Grafana integration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T16:15:47.000Z
CVE-2020-10093 
A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T13:17:16.000Z
CVE-2020-10094 
A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before LW74.PRL.P273; MS410, M1140 before LW74.PRL.P273; MS315, MS415, MS417 before LW74.TL2.P273; MS51x, MS610dn, MS617 before LW74.PR2.P273; M1145, M3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS812, MS817, MS818 before LW74.DN2.P273; MS810de, M5155, M5163 before LW74.DN4.P273; MS812de, M5170 before LW74.DN7.P273; MS91x before LW74.SA.P273; MX31x, XM1135 before LW74.SB2.P273; MX410, MX510 & MX511 before LW74.SB4.P273; XM1140, XM1145 before LW74.SB4.P273; MX610 & MX611 before LW74.SB7.P273; XM3150 before LW74.SB7.P273; MX71x, MX81x before LW74.TU.P273; XM51xx & XM71xx before LW74.TU.P273; MX91x & XM91x before LW74.MG.P273; MX6500e before LW74.JD.P273; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.P738; C950 before LHS60.TP.P738; X548 & XS548 before LHS60.VK.P738; X74x & XS748 before LHS60.NY.P738; X792 & XS79x before LHS60.MR.P738; X925 & XS925 before LHS60.HK.P738; X95x & XS95x before LHS60.TQ.P738; 6500e before LHS60.JR.P738;C734 LR.SK.P824 and earlier; C736 LR.SKE.P824 and earlier; E46x LR.LBH.P824 and earlier; T65x LR.JP.P824 and earlier; X46x LR.BS.P824 and earlier; X65x LR.MN.P824 and earlier; X73x LR.FL.P824 and earlier; W850 LP.JB.P823 and earlier; and X86x LP.SP.P823 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T13:17:04.000Z
CVE-2020-10095 
Various Lexmark devices have CSRF that allows an attacker to modify the configuration of the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-19T00:00:00.000Z
CVE-2020-10096 
An issue was discovered in Zammad 3.0 through 3.2. It does not prevent caching of confidential data within browser memory. An attacker who either remotely compromises or obtains physical access to a user's workstation can browse the browser cache contents and obtain sensitive information. The attacker does not need to be authenticated with the application to view this information, as it would be available via the browser cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:39:27.000Z
CVE-2020-10097 
An issue was discovered in Zammad 3.0 through 3.2. It may respond with verbose error messages that disclose internal application or infrastructure information. This information could aid attackers in successfully exploiting other vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:39:15.000Z
CVE-2020-10098 
An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execute within the browser of any user who opens the Ticket with the Article created from that Email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:38:39.000Z
CVE-2020-10099 
An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens the ticket or has the ticket within the Toolbar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:38:23.000Z
CVE-2020-10100 
An issue was discovered in Zammad 3.0 through 3.2. It allows for users to view ticket customer details associated with specific customers. However, the application does not properly implement access controls related to this functionality. As such, users of one company are able to access ticket data from other companies. Due to the multi-tenant nature of this application, users who can access ticket details from one organization to the next allows for users to exfiltrate potentially sensitive data of other companies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:37:51.000Z
CVE-2020-10101 
An issue was discovered in Zammad 3.0 through 3.2. The WebSocket server crashes when messages in non-JSON format are sent by an attacker. The message format is not properly checked and parsing errors not handled. This leads to a crash of the service process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:37:40.000Z
CVE-2020-10102 
An issue was discovered in Zammad 3.0 through 3.2. The Forgot Password functionality is implemented in a way that would enable an anonymous user to guess valid user emails. In the current implementation, the application responds differently depending on whether the input supplied was recognized as associated with a valid user. This behavior could be used as part of a two-stage automated attack. During the first stage, an attacker would iterate through a list of account names to determine which correspond to valid accounts. During the second stage, the attacker would use a list of common passwords to attempt to brute force credentials for accounts that were recognized by the system in the first stage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:37:31.000Z
CVE-2020-10103 
An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active Zammad session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:37:11.000Z
CVE-2020-10104 
An issue was discovered in Zammad 3.0 through 3.2. After authentication, it transmits sensitive information to the user that may be compromised and used by an attacker to gain unauthorized access. Hashed passwords are returned to the user when visiting a certain URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:37:04.000Z
CVE-2020-10105 
An issue was discovered in Zammad 3.0 through 3.2. It returns source code of static resources when submitting an OPTIONS request, rather than a GET request. Disclosure of source code allows for an attacker to formulate more precise attacks. Source code was disclosed for the file 404.html (/zammad/public/404.html)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T00:36:55.000Z
CVE-2020-10106 
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php. The SQL injection allows to dump the MySQL database and to bypass the login prompt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T12:42:22.000Z
CVE-2020-10107 
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T12:43:08.000Z
CVE-2020-10108 
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T12:42:33.000Z
CVE-2020-10109 
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T12:40:05.000Z
CVE-2020-10110 
Citrix Gateway 11.1, 12.0, and 12.1 allows Information Exposure Through Caching. NOTE: Citrix disputes this as not a vulnerability. There is no sensitive information disclosure through the cache headers on Citrix ADC. The "Via" header lists cache protocols and recipients between the start and end points for a request or a response. The "Age" header provides the age of the cached response in seconds. Both headers are commonly used for proxy cache and the information is not sensitive
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T20:32:19.000Z
CVE-2020-10111 
Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the reported behavior as not a security issue. Citrix ADC only caches HTTP/1.1 traffic for performance optimization
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T20:33:05.000Z
CVE-2020-10112 
Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static content served under certain URL paths for Citrix Gateway usage. No dynamic content is served under these paths, which implies that those cached pages would not change based on parameter values. All other data traffic going through Citrix Gateway are NOT cached by default
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-06T20:33:53.000Z
CVE-2020-10113 
cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:33:19.000Z
CVE-2020-10114 
cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:33:55.000Z
CVE-2020-10115 
cPanel before 84.0.20, when PowerDNS is used, allows arbitrary code execution as root via dnsadmin. (SEC-537).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:35:51.000Z
CVE-2020-10116 
cPanel before 84.0.20 allows attackers to bypass intended restrictions on features and demo accounts via WebDisk UAPI calls (SEC-541).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:36:40.000Z
CVE-2020-10117 
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:37:23.000Z
CVE-2020-10118 
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:38:10.000Z
CVE-2020-10119 
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:38:58.000Z
CVE-2020-10120 
cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:39:50.000Z
CVE-2020-10121 
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:40:35.000Z
CVE-2020-10122 
cPanel before 84.0.20 allows a webmail or demo account to delete arbitrary files (SEC-547).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-17T14:41:13.000Z
CVE-2020-10123 
The currency dispenser of NCR SelfSev ATMs running APTRA XFS 05.01.00 or earlier does not adequately authenticate session key generation requests from the host computer, allowing an attacker with physical access to internal ATM components to issue valid commands to dispense currency by generating a new session key that the attacker knows.
Problem types: cwe_id: CWE-305
description: CWE-305 Authentication Bypass by Primary Weakness
Affected products: vendor: NCR
product: SelfServ ATM
Published: 2020-08-21T20:30:39.511Z