Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-9040 State: PUBLISHED Published: 2020-06-08T15:21:57 Last Updated: 2024-08-04T10:19:19.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Couchbase Server Java SDK before 2.7.1.1 allows a potential attacker to forge an SSL certificate and pose as the intended peer. An attacker can leverage this flaw by crafting a cryptographically valid certificate that will be accepted by Java SDK's Netty component due to missing hostname verification. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2020-9041 State: PUBLISHED Published: 2020-06-08T15:21:37 Last Updated: 2024-08-04T10:19:19.797Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Server 6.0.3 and Couchbase Sync Gateway through 2.7.0, the Cluster management, views, query, and full-text search endpoints are vulnerable to the Slowloris denial-of-service attack because they don't more aggressively terminate slow connections. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2020-9042 State: PUBLISHED Published: 2020-06-08T15:21:22 Last Updated: 2024-08-04T10:19:19.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Couchbase Server 6.0, credentials cached by a browser can be used to perform a CSRF attack if an administrator has used their browser to check the results of a REST API request. Additional Analyst Notes: - CVE Program Container: References: - https://www.couchbase.com/resources/security#SecurityAlerts
CVE ID: CVE-2020-9043 State: PUBLISHED Published: 2020-02-17T16:53:52 Last Updated: 2024-08-04T10:19:19.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wpCentral plugin before 1.5.1 for WordPress allows disclosure of the connection key. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/wp-central/#developers - https://plugins.trac.wordpress.org/changeset?&old=2244363%40wp-central&new=2244363%40wp-central - https://wpvulndb.com/vulnerabilities/10074
CVE ID: CVE-2020-9044 State: PUBLISHED Published: 2020-03-10T19:28:30 Last Updated: 2024-08-04T10:19:19.812Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Johnson Controls Products: Metasys Application and Data Server (ADS, ADS-Lite), Metasys Extended Application and Data Server (ADX), Metasys Open Data Server (ODS), Metasys Open Application Server (OAS), Metasys Network Automation Engine (NAE55 only), Metasys Network Integration Engine (NIE55/NIE59), Metasys NAE85 and NIE85, Metasys LonWorks Control Server (LCS), Metasys System Configuration Tool (SCT), Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed
on Tool (SCT), Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) Problem Types: CWE-611 Description: XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; M
Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.us-cert.gov/ics/advisories/icsa-20-070-05
CVE ID: CVE-2020-9045 State: PUBLISHED Published: 2020-05-21T14:45:44 Last Updated: 2024-08-04T10:19:19.232Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Johnson Controls Products: Software House C•CURE 9000 v2.70, American Dynamics victor Video Management System v5.2 Problem Types: CWE-312 Description: During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management System v5.2, the credentials of the user used to perform the installation or upgrade are logged in a file. The install log file persists after the installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.johns
file persists after the installation. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.us-cert.gov/ics/advisories/ICSA-20-142-01
CVE ID: CVE-2020-9046 State: PUBLISHED Published: 2020-05-26T20:05:08 Last Updated: 2024-08-04T10:19:19.774Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Johnson Controls Products: Kantech EntraPass Security Management Software Special Edition versions 8.22 and prior, Kantech EntraPass Security Management Software Corporate Edition versions 8.22 and prior, Kantech EntraPass Security Management Software Global Edition versions 8.22 and prior Problem Types: CWE-284 Description: A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files
uld potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.us-cert.gov/ics/advisories/ICSA-20-147-02
CVE ID: CVE-2020-9047 State: PUBLISHED Published: 2020-06-26T18:01:48 Last Updated: 2024-08-04T10:19:19.396Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L) Vendors: Johnson Controls Products: exacqVision Web Service versions 20.03.2.0 and prior, exacqVision Enterprise Manager versions 20.03.3.0 and prior Problem Types: CWE-347 Description: A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious e
ersions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/ICSA-20-170-01 - https://www.johnsoncontrols.com/cyber-solutions/security-advisories
CVE ID: CVE-2020-9048 State: PUBLISHED Published: 2020-10-08T17:29:08.524001Z Last Updated: 2024-09-16T18:39:08.774Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) Vendors: Johnson Controls Products: victor Web Client version 5.4.1 and prior Problem Types: CWE-285 Description: A vulnerability in specified versions of American Dynamics victor Web Client and Software House CCURE Web Client could allow a remote unauthenticated attacker on the network to delete arbitrary files on the system or render the system unusable by conducting a Denial of Service attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions
attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.cisa.gov/ics/advisories/icsa-20-282-01
CVE ID: CVE-2020-9049 State: PUBLISHED Published: 2020-11-19T15:27:09.782887Z Last Updated: 2024-09-17T02:57:34.537Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Johnson Controls Products: victor Web Client version 5.6 and prior, C•CURE Web Client version 2.90 and prior (Note - This does not affect the new web-based C•CURE 9000 client that was introduced in C•CURE 9000 v2.90) Problem Types: CWE-285 Description: A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Met
nauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01 - https://us-cert.cisa.gov/ics/advisories/icsa-20-324-01
CVE ID: CVE-2020-9050 State: PUBLISHED Published: 2021-02-19T17:12:36.690522Z Last Updated: 2024-09-16T16:38:28.543Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Johnson Controls Products: Metasys Reporting Engine (MRE) Web Services versions 2.0 and 2.1 Problem Types: CWE 22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-s
rom the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.johnsoncontrols.com/cyber-solutions/security-advisories - https://www.us-cert.gov/ics/advisories/icsa-21-049-01
CVE ID: CVE-2020-9051 State: REJECTED Published: 2021-02-24T20:08:58 Last Updated: 2021-02-24T20:08:58 Description: No description available.
CVE ID: CVE-2020-9052 State: REJECTED Published: 2021-02-24T20:09:32 Last Updated: 2021-02-24T20:09:32 Description: No description available.
CVE ID: CVE-2020-9053 State: REJECTED Published: 2021-02-24T20:10:03 Last Updated: 2021-02-24T20:10:03 Description: No description available.
CVE ID: CVE-2020-9054 State: PUBLISHED Published: 2020-03-04T19:30:18.400Z Last Updated: 2025-10-21T23:35:50.221Z Vendors: ZyXEL Products: NAS326, NAS520, NAS540, NAS542, NSA210, NSA220, NSA220+, NSA221, NSA310, NSA320, NSA320S, NSA325, NSA325v2 Problem Types: CWE-78 Description: Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If t
e weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters, it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user, ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such, it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute ar
fted HTTP POST or GET request to a vulnerable ZyXEL device, a remote, unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However, there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example, simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has
before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326, NAS520, NAS540, and NAS542 devices. Affected models that are end-of-support: NSA210, NSA220, NSA220+, NSA221, NSA310, NSA310S, NSA320, NSA320S, NSA325 and NSA325v2 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cwe.mitre.org/data/definitions/78.html - https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml - https://kb.cert.org/vuls/id/498544/ - https://kb.cert.org/artifacts/cve-2020-9054.html - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-i
s/id/498544/ - https://kb.cert.org/artifacts/cve-2020-9054.html - https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
CVE ID: CVE-2020-9055 State: PUBLISHED Published: 2020-03-30T20:50:27.102705Z Last Updated: 2024-09-16T16:47:42.042Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Versiant Products: LYNX Customer Service Portal Problem Types: CWE-79 Description: Versiant LYNX Customer Service Portal (CSP), version 3.5.2, is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to insert malicious JavaScript that is stored and displayed to the end user. This could lead to website redirects, session cookie hijacking, or information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/9620
nformation disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/962085/ - https://csp.poha.com/lynx/
CVE ID: CVE-2020-9056 State: PUBLISHED Published: 2020-04-10T18:35:23.402893Z Last Updated: 2024-09-17T04:19:07.406Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Periscope Holdings Products: BuySpeed Problem Types: CWE-79 Description: Periscope BuySpeed version 14.5 is vulnerable to stored cross-site scripting, which could allow a local, authenticated attacker to store arbitrary JavaScript within the application. This JavaScript is subsequently displayed by the application without sanitization and is executed in the browser of the user, which could possibly cause website redirection, session hijacking, or information disclosure. This vulnerability has been p
ch could possibly cause website redirection, session hijacking, or information disclosure. This vulnerability has been patched in BuySpeed version 15.3. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/660597/ - https://support.buyspeed.com/hc/en-us/articles/360035773831-Buyspeed-15-3-0-Release-Notes
CVE ID: CVE-2020-9057 State: PUBLISHED Published: 2022-01-07T04:30:23.469790Z Last Updated: 2024-09-16T20:03:41.584Z Vendors: Linear, Silicon Labs Products: WADWAZ-1, WAPIRZ-1, 100 series, 200 series, 300 series Problem Types: CWE-311 Description: Z-Wave devices based on Silicon Labs 100, 200, and 300 series chipsets do not support encryption, allowing an attacker within radio range to take control of or cause a denial of service to a vulnerable device. An attacker can also capture and replay Z-Wave traffic. Firmware upgrades cannot directly address this vulnerability as it is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is t
is an issue with the Z-Wave specification for these legacy chipsets. One way to protect against this vulnerability is to use 500 or 700 series chipsets that support Security 2 (S2) encryption. As examples, the Linear WADWAZ-1 version 3.43 and WAPIRZ-1 version 3.43 (with 300 series chipsets) are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://doi.org/10.1109/ACCESS.2021.3138768 - https://www.kb.cert.org/vuls/id/142629
CVE ID: CVE-2020-9058 State: PUBLISHED Published: 2022-01-07T04:30:25.088470Z Last Updated: 2024-09-16T23:41:50.495Z Vendors: Linear, Dome, Jasco, Silicon Labs Products: LB60Z-1, DM501, ZW4201, 500 series Problem Types: CWE-311 Description: Z-Wave devices based on Silicon Labs 500 series chipsets using CRC-16 encapsulation, including but likely not limited to the Linear LB60Z-1 version 3.5, Dome DM501 version 4.26, and Jasco ZW4201 version 4.05, do not implement encryption or replay protection. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://d
.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://doi.org/10.1109/ACCESS.2021.3138768 - https://www.kb.cert.org/vuls/id/142629
CVE ID: CVE-2020-9059 State: PUBLISHED Published: 2022-01-07T04:30:26.522128Z Last Updated: 2024-09-16T19:25:18.358Z Vendors: Schlage, Silicon Labs Products: BE468, 500 series Problem Types: CWE-400 Description: Z-Wave devices based on Silicon Labs 500 series chipsets using S0 authentication are susceptible to uncontrolled resource consumption leading to battery exhaustion. As an example, the Schlage BE468 version 3.42 door lock is vulnerable and fails open at a low battery level. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://doi.org/10.1109
42629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://doi.org/10.1109/ACCESS.2021.3138768 - https://www.kb.cert.org/vuls/id/142629
CVE ID: CVE-2020-9060 State: PUBLISHED Published: 2022-01-07T04:30:28.026531Z Last Updated: 2024-09-16T16:33:05.408Z Vendors: ZooZ, Fibaro, Silicon Labs, Aeon Labs Products: ZEN25, ZEN20, ZST10, FGWPB-111, 500 series, ZW090-A Problem Types: CWE-346, CWE-400 Description: Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages. Additional Analyst Notes:
via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://doi.org/10.1109/ACCESS.2021.3138768 - https://www.kb.cert.org/vuls/id/142629
CVE ID: CVE-2020-9061 State: PUBLISHED Published: 2022-01-07T04:30:29.498864Z Last Updated: 2024-09-17T03:28:48.882Z Vendors: ZooZ, Silicon Labs, Samsung, Aeon Labs Products: ZST10, 500 series, 700 series, UZB-7, STH-ETH-200, ZW090-A Problem Types: CWE-285 Description: Z-Wave devices using Silicon Labs 500 and 700 series chipsets, including but not likely limited to the SiLabs UZB-7 version 7.00, ZooZ ZST10 version 6.04, Aeon Labs ZW090-A version 3.95, and Samsung STH-ETH-200 version 6.04, are susceptible to denial of service via malformed routing messages. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/142629 - https://ieeexplore.ieee.org/docume
st Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/142629 - https://ieeexplore.ieee.org/document/9663293 - https://github.com/CNK2100/VFuzz-public - https://doi.org/10.1109/ACCESS.2021.3138768 - https://www.kb.cert.org/vuls/id/142629
CVE ID: CVE-2020-9062 State: PUBLISHED Published: 2020-08-21T20:30:41.251115Z Last Updated: 2024-09-16T22:15:09.327Z Vendors: Diebold Nixdorf Products: ProCash 2100xe USB ATM Problem Types: CWE-353, CWE-306, CWE-311 Description: Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting and modifying messages to the host computer, such as the amount and value of currency being deposited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
amount and value of currency being deposited. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.cert.org/vuls/id/221785
CVE ID: CVE-2020-9063 State: PUBLISHED Published: 2020-08-21T20:30:41.703Z Last Updated: 2025-11-04T19:12:24.291Z Vendors: NCR Products: SelfServ ATM Problem Types: CWE-120 Description: NCR SelfServ ATMs running APTRA XFS 05.01.00 or earlier do not authenticate or protect the integrity of USB HID communications between the currency dispenser and the host computer, permitting an attacker with physical access to internal ATM components the ability to inject a malicious payload and execute arbitrary code with SYSTEM privileges on the host computer by causing a buffer overflow on the host. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/116713 - https
on the host. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/116713 - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-10-S1_and_S2_Critical_Update.pdf - https://www.ncr.com/content/dam/ncrcom/unsorted/jackpot_attacks_in_the_us_-_january_2018.pdf - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdf - https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Secure_white_paper-Dispenser_Security_Solution_September_2018.pdf
CVE ID: CVE-2020-9064 State: PUBLISHED Published: 2020-03-12T21:54:38 Last Updated: 2024-08-04T10:19:19.517Z Vendors: Huawei Products: Honor V30 Problem Types: Improper Authentication Description: Huawei smartphone Honor V30 with versions earlier than OxfordS-AN00A 10.0.1.167(C00E166R4P1) have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-202003116-01-smartphone-en
CVE ID: CVE-2020-9065 State: PUBLISHED Published: 2020-03-26T14:30:08 Last Updated: 2024-08-04T10:19:19.429Z Vendors: n/a Products: Taurus-AL00B Problem Types: Use-after-free Description: Huawei smart phone Taurus-AL00B with versions earlier than 10.0.0.203(C00E201R7P2) have a use-after-free (UAF) vulnerability. An authenticated, local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may tamper with the information to affect the availability. Additional Analyst Notes: - CVE Program Container: References: - https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200325-01-smartphone-en