Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
rbitrary files on an affected system. This type of vulnerability is also known as 'Zip-Slip'. (ZDI-CAN-12054) Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-156833.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-040-03 - https://www.zerodayinitiative.com/advisories/ZDI-21-253/
CVE ID: CVE-2020-25238 State: PUBLISHED Published: 2021-02-09T15:38:18 Last Updated: 2024-08-04T15:33:05.412Z Vendors: Siemens Products: PCS neo (Administration Console), TIA Portal Problem Types: CWE-284 Description: A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in specific folders could allow a local attacker to execute code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ss
tem. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-428051.pdf - https://www.kb.cert.org/vuls/id/466044 - https://us-cert.cisa.gov/ics/advisories/icsa-21-040-05
CVE ID: CVE-2020-25239 State: PUBLISHED Published: 2021-03-15T17:03:30 Last Updated: 2024-08-04T15:33:05.190Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-863 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). The webserver could allow unauthorized actions via special urls for unpriviledged users. The settings of the UMC authorization server could be changed to add a rogue server by an attacker authenticating with unprivilege user rights. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-731317.pdf
CVE ID: CVE-2020-25240 State: PUBLISHED Published: 2021-03-15T17:03:30 Last Updated: 2024-08-04T15:33:05.573Z Vendors: Siemens Products: SINEMA Remote Connect Server Problem Types: CWE-863 Description: A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0). Unpriviledged users can access services when guessing the url. An attacker could impact availability, integrity and gain information from logs and templates of the service. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-731317.pdf
CVE ID: CVE-2020-25241 State: PUBLISHED Published: 2021-03-15T17:03:30 Last Updated: 2024-08-04T15:33:05.467Z Vendors: Siemens Products: SIMATIC MV400 family Problem Types: CWE-1285 Description: A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). The underlying TCP stack of the affected products does not correctly validate the sequence number for incoming TCP RST packages. An attacker could exploit this to terminate arbitrary TCP sessions. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-599268.pdf
CVE ID: CVE-2020-25242 State: PUBLISHED Published: 2021-05-12T13:18:22 Last Updated: 2024-08-04T15:33:05.559Z Vendors: Siemens Products: SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) Problem Types: CWE-400 Description: A vulnerability has been identified in SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Lean (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Standard (incl. SIPLUS variants) (All versions). Specially crafted packets sent to TCP port 102 could cause a Denial-of-Service condition on the affected devices. A cold r
ecially crafted packets sent to TCP port 102 could cause a Denial-of-Service condition on the affected devices. A cold restart might be necessary in order to recover. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-676775.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-676775.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-131-07
CVE ID: CVE-2020-25243 State: PUBLISHED Published: 2021-04-22T20:42:19 Last Updated: 2024-11-19T15:01:36.881Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:U/RC:C) Vendors: Siemens Products: LOGO! Soft Comfort Problem Types: CWE-22 Description: A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.4). A zip slip vulnerability could be triggered while importing a compromised project file to the affected software. Chained with other vulnerabilities this vulnerability could ultimately lead to a system takeover by an attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.sieme
ker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-983300.pdf
CVE ID: CVE-2020-25244 State: PUBLISHED Published: 2021-04-22T20:42:19 Last Updated: 2024-08-04T15:33:05.434Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Siemens Products: LOGO! Soft Comfort Problem Types: CWE-427 Description: A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.4). The software insecurely loads libraries which makes it vulnerable to DLL hijacking. Successful exploitation by a local attacker could lead to a takeover of the system where the software is installed. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-983300.pdf
CVE ID: CVE-2020-25245 State: PUBLISHED Published: 2021-02-09T15:38:18 Last Updated: 2024-08-04T15:33:05.553Z Vendors: Siemens Products: DIGSI 4 Problem Types: CWE-276 Description: A vulnerability has been identified in DIGSI 4 (All versions < V4.94 SP1 HF 1). Several folders in the %PATH% are writeable by normal users. As these folders are included in the search for dlls, an attacker could place dlls there with code executed by SYSTEM. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-536315.pdf - https://us-cert.cisa.gov/ics/advisories/icsa-21-040-10
CVE ID: CVE-2020-25247 State: PUBLISHED Published: 2020-09-11T02:21:04 Last Updated: 2024-08-04T15:33:05.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase through 18.0.0.32 and 19.x through 19.8.9.1000. Directory traversal exists for writing to files, as demonstrated by the FileName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/21 - http://seclists.org/fulldisclosure/2020/Oct/9
CVE ID: CVE-2020-25248 State: PUBLISHED Published: 2020-09-11T02:20:55 Last Updated: 2024-08-04T15:33:05.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Directory traversal exists for reading files, as demonstrated by the FileName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/21 - http://seclists.org/fulldisclosure/2020/Oct/9 - https://seclists.org/fulldisclosure/2020/Oct/9
CVE ID: CVE-2020-25249 State: PUBLISHED Published: 2020-09-11T02:20:47 Last Updated: 2024-08-04T15:33:05.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. The server typically logs activity only when a client application specifies that logging is desired. This can be problematic for use cases in a regulated industry, where server-side logging is required in additional situations. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/8
CVE ID: CVE-2020-25250 State: PUBLISHED Published: 2020-09-11T02:20:39 Last Updated: 2024-08-04T15:33:05.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Client applications can write arbitrary data to the server logs. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/8
CVE ID: CVE-2020-25251 State: PUBLISHED Published: 2020-09-11T02:20:27 Last Updated: 2024-08-04T15:33:05.388Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. Client-side authentication is used for critical functions such as adding users or retrieving sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/16
CVE ID: CVE-2020-25252 State: PUBLISHED Published: 2020-09-11T02:20:19 Last Updated: 2024-08-04T15:33:05.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase through 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. CSRF can be used to log in a user, and then perform actions, because there are default credentials (the wstinol password for the manager or hsi account). Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/9
CVE ID: CVE-2020-25253 State: PUBLISHED Published: 2020-09-11T02:20:09 Last Updated: 2024-08-04T15:33:05.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by the TableName, ColumnName, Name, UserId, or Password parameter. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/7
CVE ID: CVE-2020-25254 State: PUBLISHED Published: 2020-09-11T02:20:00 Last Updated: 2024-08-04T15:33:05.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows SQL injection, as demonstrated by TestConnection_LocalOrLinkedServer, CreateFilterFriendlyView, or AddWorkViewLinkedServer. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/7 - http://seclists.org/fulldisclosure/2020/Oct/9 - https://seclists.org/fulldisclosure/2020/Oct/9
CVE ID: CVE-2020-25255 State: PUBLISHED Published: 2020-09-11T02:19:51 Last Updated: 2024-08-04T15:33:05.409Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows remote attackers to cause a denial of service (outage of connection-request processing) via a long user ID, which triggers an exception and a large log entry. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/17
CVE ID: CVE-2020-25256 State: PUBLISHED Published: 2020-09-11T02:19:35 Last Updated: 2024-08-04T15:33:05.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. PKI certificates have a private key that is the same across different customers' installations. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/18
CVE ID: CVE-2020-25257 State: PUBLISHED Published: 2020-09-11T02:19:24 Last Updated: 2024-08-04T15:33:05.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows XXE attacks for read/write access to arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/23
CVE ID: CVE-2020-25258 State: PUBLISHED Published: 2020-09-11T02:19:15 Last Updated: 2024-08-04T15:33:05.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses ASP.NET BinaryFormatter.Deserialize in a manner that allows attackers to transmit and execute bytecode in SOAP messages. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/22
CVE ID: CVE-2020-25259 State: PUBLISHED Published: 2020-09-11T02:19:03 Last Updated: 2024-08-04T15:33:05.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It uses XML deserialization libraries in an unsafe manner. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/22
CVE ID: CVE-2020-25260 State: PUBLISHED Published: 2020-09-11T02:18:53 Last Updated: 2024-08-04T15:33:05.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and below. It allows remote attackers to execute arbitrary code because of unsafe JSON deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2020/Sep/22
CVE ID: CVE-2020-25262 State: PUBLISHED Published: 2020-10-08T12:33:34 Last Updated: 2024-08-04T15:33:05.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/pages/delete/ URI: pages will be deleted. Additional Analyst Notes: - CVE Program Container: References: - https://pyrocms.com/ - https://github.com/pyrocms/pyrocms - https://gist.github.com/farid007/2af454d909fa5a60a07e4e547e99964e
CVE ID: CVE-2020-25263 State: PUBLISHED Published: 2020-10-08T12:33:20 Last Updated: 2024-08-04T15:33:05.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: PyroCMS 3.7 is vulnerable to cross-site request forgery (CSRF) via the admin/addons/uninstall/anomaly.module.blocks URI: an arbitrary plugin will be deleted. Additional Analyst Notes: - CVE Program Container: References: - https://pyrocms.com/ - https://github.com/pyrocms/pyrocms - https://gist.github.com/farid007/df51b0666643ec01d5571cbcc1e966e7
CVE ID: CVE-2020-25265 State: PUBLISHED Published: 2020-12-02T16:45:13 Last Updated: 2024-08-04T15:33:05.489Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file that contains Name= with path components. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/refi64/CVE-2020-25265-25266
CVE ID: CVE-2020-25266 State: PUBLISHED Published: 2020-12-02T16:47:53 Last Updated: 2024-08-04T15:33:05.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: AppImage appimaged before 1.0.3 does not properly check whether a downloaded file is a valid appimage. For example, it will accept a crafted mp3 file that contains an appimage, and install it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/refi64/CVE-2020-25265-25266
CVE ID: CVE-2020-25267 State: PUBLISHED Published: 2020-11-10T21:45:50 Last Updated: 2024-08-04T15:33:05.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/bugbountywriteup/exploiting-ilias-learning-management-system-4eda9e120620
CVE ID: CVE-2020-25268 State: PUBLISHED Published: 2020-11-10T21:46:03 Last Updated: 2024-08-04T15:33:05.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/bugbountywriteup/exploiting-ilias-learning-management-system-4eda9e120620
CVE ID: CVE-2020-25269 State: PUBLISHED Published: 2020-09-11T04:43:32 Last Updated: 2024-08-04T15:33:05.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server. Additional Analyst Notes: - CVE Program Container: References: - https://docs.inspircd.org/security/2020-01/ - https://github.com/inspircd/inspircd/compare/v2.0.28...07d7dea - https://github.com/inspircd/inspircd/compare/426d1c8...b3f1d
://github.com/inspircd/inspircd/compare/v2.0.28...07d7dea - https://github.com/inspircd/inspircd/compare/426d1c8...b3f1db9 - https://www.debian.org/security/2020/dsa-4764 - https://lists.debian.org/debian-lts-announce/2020/09/msg00015.html
CVE ID: CVE-2020-25270 State: PUBLISHED Published: 2020-10-08T12:32:35 Last Updated: 2024-08-04T15:33:05.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com - https://github.com/Ko-kn3t/CVE-2020-25270 - http://packetstormsecurity.com/files/159614/Hostel-Management-System-2.1-Cross-Site-Scripting.html
CVE ID: CVE-2020-25271 State: PUBLISHED Published: 2020-10-08T12:32:05 Last Updated: 2024-08-04T15:33:05.348Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/appointment-history.php, or admin/appointment-history.php. Additional Analyst Notes: - CVE Program Container: References: - https://phpgurukul.com - https://github.com/Ko-kn3t/CVE-2020-25271
CVE ID: CVE-2020-25272 State: PUBLISHED Published: 2020-10-08T12:30:26 Last Updated: 2024-08-04T15:33:05.349Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in book_now.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com - https://github.com/Ko-kn3t/CVE-2020-25272
CVE ID: CVE-2020-25273 State: PUBLISHED Published: 2020-10-08T12:34:43 Last Updated: 2024-08-04T15:33:05.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com - https://github.com/Ko-kn3t/CVE-2020-25273
CVE ID: CVE-2020-25275 State: PUBLISHED Published: 2021-01-04T16:19:08 Last Updated: 2024-08-04T15:33:05.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/security - http://www.openwall.com/lists/oss-security/2021/01/04/3 - https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html - https://www.debian.org/security/2021/dsa-4825 - http://seclists.org/fulldisclosure/2021/Jan/18 - http://packetstormsecuri
ttps://www.debian.org/security/2021/dsa-4825 - http://seclists.org/fulldisclosure/2021/Jan/18 - http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html - https://security.gentoo.org/glsa/202101-01 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GXDKFLOCUP7I4ELGQ2F4P5TGC6NXMYV7/
CVE ID: CVE-2020-25276 State: PUBLISHED Published: 2020-09-11T15:15:16 Last Updated: 2024-08-04T15:33:05.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1. When using a client certificate to enroll over the EST protocol, no revocation check is performed on that certificate. This vulnerability can only affect a system that has EST configured, uses client certificates to authenticate enrollment, and has had such a certificate revoked. This certificate needs to belong to a role that is authorized to enroll new end entities. (To completely mitigate this problem prior to upgrade, remove any revoked client certificate
to enroll new end entities. (To completely mitigate this problem prior to upgrade, remove any revoked client certificates from their respective roles.) Additional Analyst Notes: - CVE Program Container: References: - https://support.primekey.com/news/posts/ejbca-security-advisory-revocation-check-not-performed-on-est-client-certificate
CVE ID: CVE-2020-25278 State: PUBLISHED Published: 2020-09-11T21:07:14 Last Updated: 2024-08-04T15:33:05.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung IDs are SVE-2020-18088, SVE-2020-18225, SVE-2020-18301 (September 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-25279 State: PUBLISHED Published: 2020-09-11T21:06:52 Last Updated: 2024-08-04T15:33:05.359Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Exynos chipsets) software. The baseband component has a buffer overflow via an abnormal SETUP message, leading to execution of arbitrary code. The Samsung ID is SVE-2020-18098 (September 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-25280 State: PUBLISHED Published: 2020-09-11T21:07:03 Last Updated: 2024-08-04T15:33:05.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos and MediaTek chipsets) software. Unauthenticated attackers can execute LTE/5G commands by sending a debugging command over USB. The Samsung ID is SVE-2020-16979 (September 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-25281 State: PUBLISHED Published: 2020-09-11T21:18:35 Last Updated: 2024-08-04T15:33:05.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Applications with sensitive security settings (such as the package verifier application) mishandle unknown-source installations. The LG ID is LVE-SMP-190002 (September 2020). Additional Analyst Notes: - CVE Program Container: References: - https://lgsecurity.lge.com/