Kaspersky Tinycheck vulnerabilities

3 CVEs affecting Kaspersky Tinycheck, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-36200, published 2021-01-26.

More from Kaspersky.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-36199, published 2021-01-26. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places.
• CVE-2020-35929, published 2021-01-19. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. In TinyCheck before commits 9fd360d and ea53de8, the installation script of the tool contained hard-coded credentials to the backend part of the tool. This information could be used by an attacker…
• CVE-2020-36200, published 2021-01-26. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. TinyCheck before commits 9fd360d and ea53de8 allowed an authenticated attacker to send an HTTP GET request to the crafted URLs.