CVSS: 7.8EPSS: 2%CPEs: 3EXPL: 0CVE-2020-15418 – Veeam ONE SSRSReport GetCustomElementText XML External Entity Processing Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-15418
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSRSReport class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. • https://www.veeam.com/kb3221 https://www.zerodayinitiative.com/advisories/ZDI-20-821 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.8EPSS: 2%CPEs: 3EXPL: 0CVE-2020-15419 – Veeam ONE Reporter_ImportLicense Page_Load XML External Entity Processing Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-15419
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. • https://www.veeam.com/kb3221 https://www.zerodayinitiative.com/advisories/ZDI-20-822 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.2EPSS: 0%CPEs: 2EXPL: 1CVE-2019-14353
https://notcve.org/view.php?id=CVE-2019-14353
On Trezor One devices before 1.8.2, a side channel for the row-based OLED display was found. The power consumption of each row-based display cycle depends on the number of illuminated pixels, allowing a partial recovery of display contents. For example, a hardware implant in the USB cable might be able to leverage this behavior to recover confidential secrets such as the PIN and BIP39 mnemonic. In other words, the side channel is relevant only if the attacker has enough control over the device's USB connection to make power-consumption measurements at a time when secret data is displayed. The side channel is not relevant in other circumstances, such as a stolen device that is not currently displaying secret data. • https://blog.trezor.io/details-of-the-oled-vulnerability-and-its-mitigation-d331c4e2001a • CWE-203: Observable Discrepancy •