CVEvulnerability
CVE-2020-8995
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-12-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-798
Description
Programi Bilanc Build 007 Release 014 31.01.2020 supplies a .exe file containing several hardcoded credentials to different servers that allow remote attackers to gain access to the complete infrastructure including the website, update server, and external issue tracking tools.
Affected configurations
• bilanc bilanc (<= 014 31.01.2020)
Related
Weakness · CWE (1)
- CWE-798 Use of Hard-coded Credentials weakness
References
- http://seclists.org/fulldisclosure/2020/Dec/38 Mailing List, Third Party Advisory
- https://packetstormsecurity.com/files/160626/Programi-Bilanc-Build-007-Release-014-31.01.2020-Hardcoded-Credentials.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Dec/38 Mailing List, Third Party Advisory
- https://packetstormsecurity.com/files/160626/Programi-Bilanc-Build-007-Release-014-31.01.2020-Hardcoded-Credentials.html Third Party Advisory, VDB Entry