Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-3912 State: PUBLISHED Published: 2020-04-01T17:53:19 Last Updated: 2024-08-04T07:52:19.827Z Vendors: Apple Products: macOS Problem Types: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system termination or read kernel memory. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT211100
CVE ID: CVE-2020-3913 State: PUBLISHED Published: 2020-04-01T17:53:30 Last Updated: 2024-08-04T07:52:19.856Z Vendors: Apple Products: iOS, macOS, watchOS Problem Types: A malicious application may be able to elevate privileges Description: A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, watchOS 6.2. A malicious application may be able to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT211100 - https://support.apple.com/HT211102 - https://support.apple.com/HT211103
CVE ID: CVE-2020-3914 State: PUBLISHED Published: 2020-04-01T17:54:00 Last Updated: 2024-08-04T07:52:19.968Z Vendors: Apple Products: iOS, macOS, tvOS, watchOS Problem Types: An application may be able to read restricted memory Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. An application may be able to read restricted memory. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT211100 - https://support.apple.com/HT211102 - https://support.apple.com/HT211101 - https://support.apple.com/HT211103
CVE ID: CVE-2020-3915 State: PUBLISHED Published: 2020-10-22T17:47:34 Last Updated: 2024-08-04T07:52:19.837Z Vendors: Apple Products: macOS Problem Types: A malicious application may be able to overwrite arbitrary files Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/kb/HT211100
CVE ID: CVE-2020-3916 State: PUBLISHED Published: 2020-04-01T17:53:40 Last Updated: 2024-08-04T07:52:20.387Z Vendors: Apple Products: iOS, watchOS Problem Types: Setting an alternate app icon may disclose a photo without needing permission to access photos Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. Setting an alternate app icon may disclose a photo without needing permission to access photos. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT211102 - https://support.apple.com/HT211103
CVE ID: CVE-2020-3917 State: PUBLISHED Published: 2020-04-01T17:54:15 Last Updated: 2024-08-04T07:52:20.204Z Vendors: Apple Products: iOS, tvOS, watchOS Problem Types: An application may be able to use an SSH client provided by private frameworks Description: This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may be able to use an SSH client provided by private frameworks. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT211102 - https://support.apple.com/HT211101 - https://support.apple.com/HT211103
CVE ID: CVE-2020-3918 State: PUBLISHED Published: 2020-10-22T17:49:00 Last Updated: 2024-08-04T07:52:20.579Z Vendors: Apple Products: iOS, macOS, tvOS, watchOS Problem Types: A local user may be able to view sensitive user information Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A local user may be able to view sensitive user information. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/kb/HT211100 - https://support.apple.com/kb/HT211102 - https://support.apple.com/kb/HT211101 - https://support.apple.com/kb/HT211103
CVE ID: CVE-2020-3919 State: PUBLISHED Published: 2020-04-01T17:54:39 Last Updated: 2024-08-04T07:52:20.510Z Vendors: Apple Products: iOS, macOS, tvOS, watchOS Problem Types: A malicious application may be able to execute arbitrary code with kernel privileges Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A malicious application may be able to execute arbitrary code with kernel privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT211100 - https://support.apple.com/HT211102 - https://support.apple.com/HT21
: References: - https://support.apple.com/HT211100 - https://support.apple.com/HT211102 - https://support.apple.com/HT211101 - https://support.apple.com/HT211103
CVE ID: CVE-2020-3920 State: PUBLISHED Published: 2020-03-27T03:50:25.735974Z Last Updated: 2024-09-17T02:16:00.930Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Unisoon Products: UltraLog Express Problem Types: Broken Authentication Description: UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3452-937d6-1.html
CVE ID: CVE-2020-3921 State: PUBLISHED Published: 2020-03-27T03:50:26.138651Z Last Updated: 2024-09-17T01:41:03.399Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Unisoon Products: UltraLog Express Problem Types: Sensitive Data Exposure Description: UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3453-442a5-1.html
CVE ID: CVE-2020-3922 State: PUBLISHED Published: 2020-03-18T06:40:15.213698Z Last Updated: 2024-09-17T00:02:24.083Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ArmorX Products: LisoMail Problem Types: SQL Injection Description: LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tonykuo76/50350af9b77eb51f5ab55964a35f47f2 - https://www.chtsecurity.com/news/2fd99e6e-819f-42b4-a7fe-6bc7eeae155c - https://www.twcert.org.tw/tw/cp-132-3437-17241-1.html
CVE ID: CVE-2020-3923 State: PUBLISHED Published: 2020-02-27T04:00:31.892903Z Last Updated: 2024-09-16T20:26:48.745Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TONNET Products: DVR Problem Types: Broken Access Control Description: DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default password and gain access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910003 - https://www.chtsecurity.com/news/4ef5eb3a-fdc3-4d78-8dd7-ec7213e2bbcf
CVE ID: CVE-2020-3924 State: PUBLISHED Published: 2020-02-27T04:00:32.289873Z Last Updated: 2024-09-16T17:14:12.393Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: TONNET Products: DVR Problem Types: Firmware Injection Description: DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/4ef5eb3a-fdc3-4d78-8dd7-ec7213e2bbcf - https://tvn.twcert.org.tw/taiwanvn/TVN-201910004
CVE ID: CVE-2020-3925 State: PUBLISHED Published: 2020-02-03T11:00:30.831250Z Last Updated: 2024-09-17T03:22:58.327Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: CHANGING Products: ServiSign Windows versions Problem Types: Remote Code Execution Description: A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910005 - https://www.chtsecurity.com/n
- CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910005 - https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce
CVE ID: CVE-2020-3926 State: PUBLISHED Published: 2020-02-03T11:00:31.233534Z Last Updated: 2024-09-16T17:14:45.590Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: CHANGING Products: ServiSign Windows versions Problem Types: Arbitrary File Access Description: An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910006 - https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce
CVE ID: CVE-2020-3927 State: PUBLISHED Published: 2020-02-03T11:00:31.635355Z Last Updated: 2024-09-16T22:55:21.477Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: CHANGING Products: ServiSign Windows versions Problem Types: Arbitrary File Deletion Description: An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910007 - https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce
CVE ID: CVE-2020-3928 State: PUBLISHED Published: 2020-06-12T08:25:23.055079Z Last Updated: 2024-09-17T01:21:32.177Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GeoVision Products: Door Access Control Device Problem Types: Hardcoded privileged password Description: GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3695-9e72d-1.html
CVE ID: CVE-2020-3929 State: PUBLISHED Published: 2020-06-12T08:25:23.476254Z Last Updated: 2024-09-17T02:26:42.600Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GeoVision Products: Door Access Control Device Problem Types: Shared cryptographic keys Description: GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3696-6601c-1.html
CVE ID: CVE-2020-3930 State: PUBLISHED Published: 2020-06-12T08:25:23.937925Z Last Updated: 2024-09-16T16:57:40.077Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GeoVision Products: Door Access Control Device Problem Types: Information disclosure vulnerability Description: GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3697-780d0-1.html
CVE ID: CVE-2020-3931 State: PUBLISHED Published: 2020-07-08T10:05:21.030166Z Last Updated: 2024-09-16T17:23:37.841Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: GeoVision Products: Door Access Control Device Problem Types: CWE-120 Description: Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3754-b77d0-1.html - https://www.acronis.com/en-us/blog/posts/backdoor-wide-open-critical-vulnerabilities-uncovered-geovision
CVE ID: CVE-2020-3932 State: PUBLISHED Published: 2020-04-15T06:20:24.488515Z Last Updated: 2024-09-16T22:51:54.461Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: DRAYTEK CORP. Products: VigorAP910C Problem Types: Information Leakage Description: A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-3537-1e215-1.html
CVE ID: CVE-2020-3933 State: PUBLISHED Published: 2020-02-11T08:00:29.196999Z Last Updated: 2024-09-17T03:23:28.966Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: TAIWAN SECOM CO., LTD. Products: Door Access Control system, Personnel Attendance system Problem Types: User Account Enumeration Description: TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/en/cp-139-3317-d4edc-2.html - https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac - https://g
t.org.tw/en/cp-139-3317-d4edc-2.html - https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac - https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b
CVE ID: CVE-2020-3934 State: PUBLISHED Published: 2020-02-11T08:00:29.639350Z Last Updated: 2024-09-17T01:45:45.481Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TAIWAN SECOM CO., LTD. Products: Door Access Control system, Personnel Attendance system Problem Types: Pre-auth SQL Injection Description: TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac - https://gist.github.com/cht
ainer: References: - https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac - https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b - https://www.twcert.org.tw/en/cp-139-3318-89f76-2.html
CVE ID: CVE-2020-3935 State: PUBLISHED Published: 2020-02-11T08:00:30.076262Z Last Updated: 2024-09-16T22:19:57.599Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: TAIWAN SECOM CO., LTD. Products: Door Access Control system, Personnel Attendance system Problem Types: Sensitivity Information Exposure Description: TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers. Additional Analyst Notes: - CVE Program Container: References: - https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac - https://gist.github.com/chtsecurit
References: - https://www.chtsecurity.com/news/1bb85fcd-9048-4587-b4d3-b18335572bac - https://gist.github.com/chtsecurity/4db471b34c3959e5ab9ec31570e4760b - https://www.twcert.org.tw/en/cp-139-3319-d7b65-2.html
CVE ID: CVE-2020-3936 State: PUBLISHED Published: 2020-03-27T03:50:26.586943Z Last Updated: 2024-09-16T22:51:08.505Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Unisoon Products: UltraLog Express Problem Types: CWE-89 Description: UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-3451-7d9f0-1.html
CVE ID: CVE-2020-3937 State: PUBLISHED Published: 2020-02-04T04:15:21.658154Z Last Updated: 2024-09-16T17:57:51.194Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CHANGING Products: Syuan-Gu-Da-Shih Problem Types: SQL-injection Description: SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the database. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910013 - https://www.chtsecurity.com/news/a791f509-9782-4be1-b71f-22fc619f8215
CVE ID: CVE-2020-3938 State: PUBLISHED Published: 2020-02-04T04:15:22.050637Z Last Updated: 2024-09-16T17:38:53.967Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CHANGING Products: Syuan-Gu-Da-Shih Problem Types: Request-Forgery Description: SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910014 - https://www.chtsecurity.com/news/a791f509-9782-4be1-b71f-22fc619f8215
CVE ID: CVE-2020-3939 State: PUBLISHED Published: 2020-02-04T04:15:22.493511Z Last Updated: 2024-09-17T01:36:41.076Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: CHANGING Products: Syuan-Gu-Da-Shih Problem Types: Request-Forgery Description: SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked to attackers via the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://tvn.twcert.org.tw/taiwanvn/TVN-201910015 - https://www.chtsecurity.com/news/a791f509-9782-4be1-b71f-22fc619f8215
CVE ID: CVE-2020-3940 State: PUBLISHED Published: 2020-01-17T17:59:29 Last Updated: 2024-08-04T07:52:20.417Z Vendors: VMware Products: Workspace ONE SDK Problem Types: Sensitive information disclosure Description: VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0001.html
CVE ID: CVE-2020-3941 State: PUBLISHED Published: 2020-01-15T19:03:19 Last Updated: 2024-08-04T07:52:20.398Z Vendors: VMware Products: VMware Tools for Windows (VMware Tools) Problem Types: VMware Tools privilege escalation vulnerability Description: The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is installed. This vulnerability is not present in VMware Tools 11.x.y since the affected functionality is not present in VMware Tools 11. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0002.html
CVE ID: CVE-2020-3943 State: PUBLISHED Published: 2020-02-19T20:04:00 Last Updated: 2024-08-04T07:52:20.381Z Vendors: VMWare Products: vRealize Operations for Horizon Adapter Problem Types: Remote code execution vulnerability Description: vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to execute arbitrary code in vRealize Operations. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0003.html
CVE ID: CVE-2020-3944 State: PUBLISHED Published: 2020-02-19T20:03:57 Last Updated: 2024-08-04T07:52:20.339Z Vendors: VMWare Products: vRealize Operations for Horizon Adapter Problem Types: Authentication bypass vulnerability Description: vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication bypass. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to bypass Adapter authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0003.html
CVE ID: CVE-2020-3945 State: PUBLISHED Published: 2020-02-19T20:03:54 Last Updated: 2024-08-04T07:52:20.842Z Vendors: VMWare Products: vRealize Operations for Horizon Adapter Problem Types: Information disclosure vulnerability Description: vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due to incorrect pairing implementation between the vRealize Operations for Horizon Adapter and Horizon View. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may obtain sensitive information Additional Analyst Notes: - CVE Program Container: References: -
rizon Adapter running, may obtain sensitive information Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0003.html
CVE ID: CVE-2020-3946 State: PUBLISHED Published: 2020-04-20T19:06:54 Last Updated: 2024-08-04T07:52:20.295Z Vendors: VMware Products: InstallBuilder Problem Types: n/a Description: InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service). Additional Analyst Notes: - CVE Program Container: References: - https://blog.installbuilder.com/2019/12/configure-autoupdate-project-settings.html
CVE ID: CVE-2020-3947 State: PUBLISHED Published: 2020-03-16T17:21:09 Last Updated: 2024-08-04T07:52:20.506Z Vendors: VMware Products: Workstation, Fusion Problem Types: Use-after-free vulnerability Description: VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition of the vmnetdhcp service running on the host machine. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0004.html
CVE ID: CVE-2020-3948 State: PUBLISHED Published: 2020-03-16T17:17:39 Last Updated: 2024-08-04T07:52:20.515Z Vendors: VMware Products: Workstation, Fusion Problem Types: Local privilege escalation vulnerability Description: Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnerability due to improper file permissions in Cortado Thinprint. Local attackers with non-administrative access to a Linux guest VM with virtual printing enabled may exploit this issue to elevate their privileges to root on the same guest VM. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/secur
root on the same guest VM. Additional Analyst Notes: - CVE Program Container: References: - https://www.vmware.com/security/advisories/VMSA-2020-0004.html