rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-9402 
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T14:49:57.000Z
CVE-2020-9403 
In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable format, and may be retrieved by any user with access to the PACTware workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-11T18:26:06.000Z
CVE-2020-9404 
In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by an attacker with no knowledge of the current passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-11T18:24:36.000Z
CVE-2020-9405 
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T00:00:00.000Z
CVE-2020-9406 
IBL Online Weather before 4.3.5a allows unauthenticated eval injection via the queryBCP method of the Auxiliary Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T00:00:00.000Z
CVE-2020-9407 
IBL Online Weather before 4.3.5a allows attackers to obtain sensitive information by reading the IWEBSERVICE_JSONRPC_COOKIE cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-25T00:00:00.000Z
CVE-2020-9408 TIBCO Spotfire Server Script Trust Problem Exposes Remote Code Execution Vulnerability
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a vulnerability that theoretically allows an attacker with write permissions to the Spotfire Library, but not "Script Author" group permission, to modify attributes of files and objects saved to the library such that the system treats them as trusted. This could allow an attacker to cause the Spotfire Web Player, Analyst clients, and TERR Service into executing arbitrary code with the privileges of the system account that started those processes. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.8.0 and below and TIBCO Spotfire Server: versions 7.11.9 and below, versions 7.12.0, 7.13.0, 7.14.0, 10.0.0, 10.0.1, 10.1.0, 10.2.0, 10.3.0, 10.3.1, 10.3.2, 10.3.3, 10.3.4, 10.3.5, and 10.3.6, versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, and 10.8.0.
Problem types: description: The impact of this vulnerability includes the theoretical possibility that an attacker could execute arbitrary code with the privileges of the system account that started the Spotfire Web Player, Analyst clients, or TERR Service.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
Published: 2020-03-11T19:55:12.878Z
CVE-2020-9409 TIBCO JasperReports Server Fails To Enforce Access Restrictions
The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.1.1 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.1.1 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.
Problem types: description: The impact of this vulnerability includes the possibility that an unauthenticated user obtains JasperReports Server "superuser" permission, and further might be able to execute arbitrary code with the system account that started the affected component.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-05-20T12:25:13.045Z
CVE-2020-9410 TIBCO JasperReports Library
The report generator component of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an attacker to exploit HTML injection to gain full control of a web interface containing the output of the report generator component with the privileges of any user that views the affected report(s). The attacker can theoretically exploit this vulnerability when other users view a maliciously generated report, where those reports use Fusion Charts and a data source with contents controlled by the attacker. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions 7.1.1 and below, versions 7.2.0 and 7.2.1, version 7.3.0, version 7.5.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions 7.1.1 and below, TIBCO JasperReports Server: versions 7.1.1 and below, version 7.2.0, version 7.5.0, TIBCO JasperReports Server for AWS Marketplace: versions 7.5.0 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.
Problem types: description: The impact of this vulnerability includes the possibility that an attacker could gain full control of the web interface displaying a generated report. Since the TIBCO JasperReports Library is used to generate reports as a component of web interfaces, the theoretical impact of this vulnerability is that the attacker can obtain the privileges of the highest privileged owner that views a maliciously generated report.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Library for ActiveMatrix BPM
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO JasperReports Server for ActiveMatrix BPM
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2020-05-20T12:25:13.466Z
CVE-2020-9411 TIBCO Managed File Transfer Platform Server for IBM i Authentication Bypass
The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows an attacker to perform unauthorized network file transfers to and from the file system accessible to the affected component. This vulnerability is exploitable when the configuration option 'Require Node Resp' is set to 'No'. In the event of a successful exploit, the attacker could theoretically read and write any file on the file system accessible to the affected component, thus fully affecting the confidentiality, integrity, and availability of the operating system hosting the deployment of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.
Problem types: description: The impact of this vulnerability includes the possibility that an attacker could gain access to the contents of files they are otherwise not authorized to see, and modify files they otherwise should not be able to change, and affect the availability of the hosting system, by way of damaging critical system files.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Platform Server for IBM i
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-06-09T17:00:20.479Z
CVE-2020-9412 TIBCO Managed File Transfer Platform Server for IBM i Arbitrary Command Execution
The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a failed file transfer. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i: versions 7.1.0 and below, version 8.0.0.
Problem types: description: The impact of this vulnerability includes the possibility that an unauthenticated attacker could execute arbitrary commands on the system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Platform Server for IBM i
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-06-09T17:00:21.287Z
CVE-2020-9413 TIBCO Managed File Transfer reflected XSS vulerability
The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrary commands on the affected system. If the attacker convinces an authenticated user with a currently active session to enter or click on the URL the commands will be executed on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
Problem types: description: The impact of this vulnerability includes the possibility that an attacker can gain access to  the session ID of the affected user's session and take any action the affected user has privilege to perform.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Command Center
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Internet Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2020-06-30T19:40:14.183Z
CVE-2020-9414 TIBCO Managed File Transfer reflected XSS vulerability
The MFT admin service component of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contains a vulnerability that theoretically allows an authenticated user with specific permissions to obtain the session identifier of another user. The session identifier when replayed could provide administrative rights or file transfer permissions to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center: versions 8.2.1 and below and TIBCO Managed File Transfer Internet Server: versions 8.2.1 and below.
Problem types: description: The impact of this vulnerability includes the possibility that an attacker could gain administrative control of the affected system.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Command Center
vendor: TIBCO Software Inc.
product: TIBCO Managed File Transfer Internet Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-06-30T19:40:14.588Z
CVE-2020-9415 TIBCO Data Virtualization
The TIBCO Data Virtualization Server component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains a vulnerability that theoretically allows a malicious authenticated user to download any arbitrary file from the affected system. The user must be authenticated and have privileges required to monitor the server in an operational capacity. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 7.0.8 and below, versions 8.0.0, 8.1.0, 8.1.1, and 8.2.0 and TIBCO Data Virtualization for AWS Marketplace: versions 8.2.0 and below.
Problem types: description: The impact of these vulnerabilities includes the theoretical possibility that a malicious user could exfiltrate any data file on the affected system. The malicious user cannot modify or delete any files on the affected system with this vulnerability.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Data Virtualization
vendor: TIBCO Software Inc.
product: TIBCO Data Virtualization for AWS Marketplace
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-08-18T18:50:11.750Z
CVE-2020-9416 TIBCO Spotfire Stored Cross Site Scripting Vulnerability
The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Desktop, and TIBCO Spotfire Server contains a vulnerability that theoretically allows a legitimate user to inject scripts. If executed by a victim authenticated to the affected system these scripts will be executed at the privileges of the victim. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1, TIBCO Spotfire Desktop: versions 10.7.0, 10.8.0, 10.9.0, and 10.10.0, and TIBCO Spotfire Server: versions 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, and 10.10.1.
Problem types: description: The theoretical impact of this vulnerability is that the attacker can execute scripts on the affected system of the victim that will execute with the privileges of the victim. If the victim has administrative privileges the attacker's injected scripts would allow the attacker to access all files, stop/start some services and change limited configuration settings.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analyst
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Analytics Platform for AWS Marketplace
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Desktop
vendor: TIBCO Software Inc.
product: TIBCO Spotfire Server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
version: 3.1
Published: 2020-09-15T18:55:11.663Z
CVE-2020-9417 TIBCO Foresight SQL Injection
The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction Insight, and TIBCO Foresight Transaction Insight Healthcare Edition contains a vulnerability that theoretically allows an authenticated attacker to perform SQL injection. Affected releases are TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Archive and Retrieval System Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Operational Monitor Healthcare Edition: versions 5.1.0 and below, version 5.2.0, TIBCO Foresight Transaction Insight: versions 5.1.0 and below, version 5.2.0, and TIBCO Foresight Transaction Insight Healthcare Edition: versions 5.1.0 and below, version 5.2.0.
Problem types: description: The impact of these vulnerabilities includes the theoretical possibility that an authenticated attacker could craft a SQL query that would allow the attacker to create records, and read, update or delete entries in a victim’s account.
Affected products: vendor: TIBCO Software Inc.
product: TIBCO Foresight Archive and Retrieval System
vendor: TIBCO Software Inc.
product: TIBCO Foresight Archive and Retrieval System Healthcare Edition
vendor: TIBCO Software Inc.
product: TIBCO Foresight Operational Monitor
vendor: TIBCO Software Inc.
product: TIBCO Foresight Operational Monitor Healthcare Edition
vendor: TIBCO Software Inc.
product: TIBCO Foresight Transaction Insight
vendor: TIBCO Software Inc.
product: TIBCO Foresight Transaction Insight Healthcare Edition
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
Published: 2020-10-20T21:13:25.229Z
CVE-2020-9418 
An untrusted search path vulnerability in the installer of PDFescape Desktop version 4.0.22 and earlier allows an attacker to gain privileges and execute code via DLL hijacking.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-05T15:23:48.000Z
CVE-2020-9419 
Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary web script or HTML via the hostName and domain_name parameters present in the LAN configuration section of the administrative dashboard.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2020-9420 
The login password of the web administrative dashboard in Arcadyan Wifi routers VRV9506JAC23 is sent in cleartext, allowing an attacker to sniff and intercept traffic to learn the administrative credentials to the router.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-14T00:00:00.000Z
CVE-2020-9423 
LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality to add documents. Those documents could then be used for multiple tasks, such as version control, shared among users, applying tags, etc. This functionality could be abused by an unauthenticated attacker to upload an arbitrary file in a restricted folder. This would lead to the executions of malicious commands with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-18T21:04:55.000Z
CVE-2020-9425 
An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in the disclosure of cleartext credentials in the response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-20T17:42:54.000Z
CVE-2020-9426 
OX Guard 2.10.3 and earlier allows XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T14:55:16.000Z
CVE-2020-9427 
OX Guard 2.10.3 and earlier allows SSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-15T14:52:22.000Z
CVE-2020-9428 
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the EAP dissector could crash. This was addressed in epan/dissectors/packet-eap.c by using more careful sscanf parsing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T22:06:50.000Z
CVE-2020-9429 
In Wireshark 3.2.0 to 3.2.1, the WireGuard dissector could crash. This was addressed in epan/dissectors/packet-wireguard.c by handling the situation where a certain data structure intentionally has a NULL value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T22:06:39.000Z
CVE-2020-9430 
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the WiMax DLMAP dissector could crash. This was addressed in plugins/epan/wimax/msg_dlmap.c by validating a length field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T22:06:26.000Z
CVE-2020-9431 
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T22:06:10.000Z
CVE-2020-9432 
openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T22:40:15.000Z
CVE-2020-9433 
openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T22:40:06.000Z
CVE-2020-9434 
openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-27T22:39:57.000Z
CVE-2020-9435 
PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate (and key) that is used by default for web-based services on the device. Impersonation, man-in-the-middle, or passive decryption attacks are possible if the generic certificate is not replaced by a device-specific certificate during installation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:25:33.000Z
CVE-2020-9436 
PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3, TC ROUTER 2002T-3G through 2.05.3, TC ROUTER 3002T-4G VZW through 2.05.3, TC ROUTER 3002T-4G ATT through 2.05.3, TC CLOUD CLIENT 1002-4G through 2.03.17, and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices allow authenticated users to inject system commands through a modified POST request to a specific URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-12T13:22:42.000Z