auren-research/cyber-sec huggingface dataset:
cveID: CVE-2018-13374
vendorProject: Fortinet
product: FortiOS and FortiADC
vulnerabilityName: Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
dateAdded: 2022-09-08
shortDescription: Fortinet FortiOS and FortiADC contain an improper access control vulnerability that allows attackers to obtain the LDAP server login credentials configured in FortiGate by pointing a LDAP server connectivity test request to a rogue LDAP server.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-29
knownRansomwareCampaignUse: Known
notes: https://www.fortiguard.com/psirt/FG-IR-18-157; https://nvd.nist.gov/vuln/detail/CVE-2018-13374
cwes: CWE-732
cveID: CVE-2017-5521
vendorProject: NETGEAR
product: Multiple Devices
vulnerabilityName: NETGEAR Multiple Devices Exposure of Sensitive Information Vulnerability
dateAdded: 2022-09-08
shortDescription: Multiple NETGEAR devices are prone to admin password disclosure via simple crafted requests to the web management server.
requiredAction: Apply updates per vendor instructions. If the affected device has since entered end-of-life, it should be disconnected if still in use.
dueDate: 2022-09-29
knownRansomwareCampaignUse: Unknown
notes: https://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability; https://nvd.nist.gov/vuln/detail/CVE-2017-5521
cwes: CWE-200
cveID: CVE-2011-4723
vendorProject: D-Link
product: DIR-300 Router
vulnerabilityName: D-Link DIR-300 Router Cleartext Storage of a Password Vulnerability
dateAdded: 2022-09-08
shortDescription: The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-09-29
knownRansomwareCampaignUse: Unknown
notes: https://www.dlink.com/uk/en/support/product/dir-300-wireless-g-router; https://nvd.nist.gov/vuln/detail/CVE-2011-4723
cwes: CWE-310
cveID: CVE-2011-1823
vendorProject: Android
product: Android OS
vulnerabilityName: Android OS Privilege Escalation Vulnerability
dateAdded: 2022-09-08
shortDescription: The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-29
knownRansomwareCampaignUse: Unknown
notes: https://android.googlesource.com/platform/system/vold/+/c51920c82463b240e2be0430849837d6fdc5352e; https://nvd.nist.gov/vuln/detail/CVE-2011-1823
cwes: CWE-189
cveID: CVE-2022-26352
vendorProject: dotCMS
product: dotCMS
vulnerabilityName: dotCMS Unrestricted Upload of File Vulnerability
dateAdded: 2022-08-25
shortDescription: dotCMS ContentResource API contains an unrestricted upload of file with a dangerous type vulnerability that allows for directory traversal, in which the file is saved outside of the intended storage location. Exploitation allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Known
notes: https://www.dotcms.com/security/SI-62; https://nvd.nist.gov/vuln/detail/CVE-2022-26352
cwes: CWE-22
CWE-138
cveID: CVE-2022-24706
vendorProject: Apache
product: CouchDB
vulnerabilityName: Apache CouchDB Insecure Default Initialization of Resource Vulnerability
dateAdded: 2022-08-25
shortDescription: Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00; https://nvd.nist.gov/vuln/detail/CVE-2022-24706
cwes: CWE-1188
cveID: CVE-2022-24112
vendorProject: Apache
product: APISIX
vulnerabilityName: Apache APISIX Authentication Bypass Vulnerability
dateAdded: 2022-08-25
shortDescription: Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94; https://nvd.nist.gov/vuln/detail/CVE-2022-24112
cwes: CWE-290
cveID: CVE-2022-22963
vendorProject: VMware Tanzu
product: Spring Cloud
vulnerabilityName: VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
dateAdded: 2022-08-25
shortDescription: When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://tanzu.vmware.com/security/cve-2022-22963; https://nvd.nist.gov/vuln/detail/CVE-2022-22963
cwes: CWE-94
cveID: CVE-2022-2294
vendorProject: WebRTC
product: WebRTC
vulnerabilityName: WebRTC Heap Buffer Overflow Vulnerability
dateAdded: 2022-08-25
shortDescription: WebRTC, an open-source project providing web browsers with real-time communication, contains a heap buffer overflow vulnerability that allows an attacker to perform shellcode execution. This vulnerability impacts web browsers using WebRTC including but not limited to Google Chrome.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Known
notes: https://groups.google.com/g/discuss-webrtc/c/5KBtZx2gvcQ; https://nvd.nist.gov/vuln/detail/CVE-2022-2294
cwes: CWE-122
cveID: CVE-2021-39226
vendorProject: Grafana Labs
product: Grafana
vulnerabilityName: Grafana Authentication Bypass Vulnerability
dateAdded: 2022-08-25
shortDescription: Grafana contains an authentication bypass vulnerability that allows authenticated and unauthenticated users to view and delete all snapshot data, potentially resulting in complete snapshot data loss.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://grafana.com/blog/2021/10/05/grafana-7.5.11-and-8.1.6-released-with-critical-security-fix/; https://nvd.nist.gov/vuln/detail/CVE-2021-39226
cwes: CWE-287
cveID: CVE-2021-38406
vendorProject: Delta Electronics
product: DOPSoft 2
vulnerabilityName: Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability
dateAdded: 2022-08-25
shortDescription: Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation) resulting in an out-of-bounds write that allows for code execution.
requiredAction: The impacted product is end-of-life and should be disconnected if still in use.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://www.cisa.gov/uscert/ics/advisories/icsa-21-252-02; https://nvd.nist.gov/vuln/detail/CVE-2021-38406
cwes: CWE-787
cveID: CVE-2021-31010
vendorProject: Apple
product: iOS, macOS, watchOS
vulnerabilityName: Apple iOS, macOS, watchOS Sandbox Bypass Vulnerability
dateAdded: 2022-08-25
shortDescription: In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-us/HT212804, https://support.apple.com/en-us/HT212805, https://support.apple.com/en-us/HT212806, https://support.apple.com/en-us/HT212807, https://support.apple.com/en-us/HT212824; https://nvd.nist.gov/vuln/detail/CVE-2021-31010
cwes: CWE-20
CWE-502
cveID: CVE-2020-36193
vendorProject: PEAR
product: Archive_Tar
vulnerabilityName: PEAR Archive_Tar Improper Link Resolution Vulnerability
dateAdded: 2022-08-25
shortDescription: PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916, https://www.drupal.org/sa-core-2021-001, https://access.redhat.com/security/cve/cve-2020-36193; https://nvd.nist.gov/vuln/detail/CVE-2020-36193
cwes: CWE-22
CWE-59
cveID: CVE-2020-28949
vendorProject: PEAR
product: Archive_Tar
vulnerabilityName: PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
dateAdded: 2022-08-25
shortDescription: PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-15
knownRansomwareCampaignUse: Unknown
notes: https://pear.php.net/bugs/bug.php?id=27002, https://www.drupal.org/sa-core-2020-013, https://access.redhat.com/security/cve/cve-2020-28949; https://nvd.nist.gov/vuln/detail/CVE-2020-28949
cwes: CWE-74
cveID: CVE-2022-0028
vendorProject: Palo Alto Networks
product: PAN-OS
vulnerabilityName: Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
dateAdded: 2022-08-22
shortDescription: A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-12
knownRansomwareCampaignUse: Unknown
notes: https://security.paloaltonetworks.com/CVE-2022-0028; https://nvd.nist.gov/vuln/detail/CVE-2022-0028
cwes: CWE-940
cveID: CVE-2022-22536
vendorProject: SAP
product: Multiple Products
vulnerabilityName: SAP Multiple Products HTTP Request Smuggling Vulnerability
dateAdded: 2022-08-18
shortDescription: SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-08
knownRansomwareCampaignUse: Unknown
notes: SAP users must have an account in order to login and access the patch. https://accounts.sap.com/saml2/idp/sso; https://nvd.nist.gov/vuln/detail/CVE-2022-22536
cwes: CWE-444
cveID: CVE-2022-32894
vendorProject: Apple
product: iOS and macOS
vulnerabilityName: Apple iOS and macOS Out-of-Bounds Write Vulnerability
dateAdded: 2022-08-18
shortDescription: Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow an application to execute code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-08
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-gb/HT213412, https://support.apple.com/en-gb/HT213413; https://nvd.nist.gov/vuln/detail/CVE-2022-32894
cwes: CWE-20
CWE-787
cveID: CVE-2022-32893
vendorProject: Apple
product: iOS and macOS
vulnerabilityName: Apple iOS and macOS Out-of-Bounds Write Vulnerability
dateAdded: 2022-08-18
shortDescription: Apple iOS and macOS contain an out-of-bounds write vulnerability that could allow for remote code execution when processing malicious crafted web content.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-08
knownRansomwareCampaignUse: Unknown
notes: https://support.apple.com/en-gb/HT213412, https://support.apple.com/en-gb/HT213413; https://nvd.nist.gov/vuln/detail/CVE-2022-32893
cwes: CWE-20
CWE-787
cveID: CVE-2022-2856
vendorProject: Google
product: Chromium Intents
vulnerabilityName: Google Chromium Intents Insufficient Input Validation Vulnerability
dateAdded: 2022-08-18
shortDescription: Google Chromium Intents contains an insufficient validation of untrusted input vulnerability that allows a remote attacker to browse to a malicious website via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-08
knownRansomwareCampaignUse: Unknown
notes: https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html; https://nvd.nist.gov/vuln/detail/CVE-2022-2856
cwes: CWE-20
cveID: CVE-2022-26923
vendorProject: Microsoft
product: Active Directory
vulnerabilityName: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability
dateAdded: 2022-08-18
shortDescription: An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-08
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26923; https://nvd.nist.gov/vuln/detail/CVE-2022-26923
cwes: CWE-295
cveID: CVE-2022-21971
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Runtime Remote Code Execution Vulnerability
dateAdded: 2022-08-18
shortDescription: Microsoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-08
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21971; https://nvd.nist.gov/vuln/detail/CVE-2022-21971
cwes: CWE-824
cveID: CVE-2017-15944
vendorProject: Palo Alto Networks
product: PAN-OS
vulnerabilityName: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
dateAdded: 2022-08-18
shortDescription: Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-08
knownRansomwareCampaignUse: Unknown
notes: https://security.paloaltonetworks.com/CVE-2017-15944; https://nvd.nist.gov/vuln/detail/CVE-2017-15944
cveID: CVE-2022-27925
vendorProject: Synacor
product: Zimbra Collaboration Suite (ZCS)
vulnerabilityName: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
dateAdded: 2022-08-11
shortDescription: Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-01
knownRansomwareCampaignUse: Known
notes: https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2022-27925
cwes: CWE-22
cveID: CVE-2022-37042
vendorProject: Synacor
product: Zimbra Collaboration Suite (ZCS)
vulnerabilityName: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
dateAdded: 2022-08-11
shortDescription: Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-09-01
knownRansomwareCampaignUse: Known
notes: https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2022-37042
cwes: CWE-23
cveID: CVE-2022-34713
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
dateAdded: 2022-08-09
shortDescription: A remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-30
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713; https://nvd.nist.gov/vuln/detail/CVE-2022-34713
cveID: CVE-2022-30333
vendorProject: RARLAB
product: UnRAR
vulnerabilityName: RARLAB UnRAR Directory Traversal Vulnerability
dateAdded: 2022-08-09
shortDescription: RARLAB UnRAR on Linux and UNIX contains a directory traversal vulnerability, allowing an attacker to write to files during an extract (unpack) operation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-30
knownRansomwareCampaignUse: Known
notes: Vulnerability updated with version 6.12. Accessing link will download update information: https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz; https://nvd.nist.gov/vuln/detail/CVE-2022-30333
cwes: CWE-22
CWE-59
cveID: CVE-2022-27924
vendorProject: Synacor
product: Zimbra Collaboration Suite (ZCS)
vulnerabilityName: Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
dateAdded: 2022-08-04
shortDescription: Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-25
knownRansomwareCampaignUse: Known
notes: https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24.1#Security_Fixes; https://nvd.nist.gov/vuln/detail/CVE-2022-27924
cwes: CWE-93
cveID: CVE-2022-26138
vendorProject: Atlassian
product: Confluence
vulnerabilityName: Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability
dateAdded: 2022-07-29
shortDescription: Atlassian Questions For Confluence App has hard-coded credentials, exposing the username and password in plaintext. A remote unauthenticated attacker can use these credentials to log into Confluence and access all content accessible to users in the confluence-users group.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-19
knownRansomwareCampaignUse: Unknown
notes: https://confluence.atlassian.com/doc/questions-for-confluence-security-advisory-2022-07-20-1142446709.html; https://nvd.nist.gov/vuln/detail/CVE-2022-26138
cwes: CWE-798
cveID: CVE-2022-22047
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability
dateAdded: 2022-07-12
shortDescription: Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-08-02
knownRansomwareCampaignUse: Unknown
notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22047; https://nvd.nist.gov/vuln/detail/CVE-2022-22047
cwes: CWE-426
cveID: CVE-2022-26925
vendorProject: Microsoft
product: Windows
vulnerabilityName: Microsoft Windows LSA Spoofing Vulnerability
dateAdded: 2022-07-01
shortDescription: Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.
requiredAction: Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].
dueDate: 2022-07-22
knownRansomwareCampaignUse: Unknown
notes: WARNING: This update is required on all Microsoft Windows endpoints but if deployed to domain controllers without additional configuration changes the update breaks PIV/CAC authentication. Read CISA implementation guidance carefully before deploying to domain controllers.; https://nvd.nist.gov/vuln/detail/CVE-2022-26925
cwes: CWE-306
cveID: CVE-2022-29499
vendorProject: Mitel
product: MiVoice Connect
vulnerabilityName: Mitel MiVoice Connect Data Validation Vulnerability
dateAdded: 2022-06-27
shortDescription: The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Known
notes: https://nvd.nist.gov/vuln/detail/CVE-2022-29499
cwes: CWE-20
cveID: CVE-2021-30533
vendorProject: Google
product: Chromium PopupBlocker
vulnerabilityName: Google Chromium PopupBlocker Security Bypass Vulnerability
dateAdded: 2022-06-27
shortDescription: Google Chromium PopupBlocker contains an insufficient policy enforcement vulnerability that allows a remote attacker to bypass navigation restrictions via a crafted iframe. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-30533
cwes: CWE-863
cveID: CVE-2021-4034
vendorProject: Red Hat
product: Polkit
vulnerabilityName: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability
dateAdded: 2022-06-27
shortDescription: The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-4034
cwes: CWE-787
cveID: CVE-2021-30983
vendorProject: Apple
product: iOS and iPadOS
vulnerabilityName: Apple iOS and iPadOS Buffer Overflow Vulnerability
dateAdded: 2022-06-27
shortDescription: Apple iOS and iPadOS contain a buffer overflow vulnerability that could allow an application to execute code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2021-30983
cwes: CWE-119
cveID: CVE-2020-3837
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Memory Corruption Vulnerability
dateAdded: 2022-06-27
shortDescription: Apple iOS, iPadOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-3837
cwes: CWE-787
cveID: CVE-2020-9907
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Memory Corruption Vulnerability
dateAdded: 2022-06-27
shortDescription: Apple iOS, iPadOS, and tvOS contain a memory corruption vulnerability that could allow an application to execute code with kernel privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2020-9907
cwes: CWE-787
cveID: CVE-2019-8605
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Use-After-Free Vulnerability
dateAdded: 2022-06-27
shortDescription: A use-after-free vulnerability in Apple iOS, macOS, tvOS, and watchOS could allow a malicious application to execute code with system privileges.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2019-8605
cwes: CWE-416
cveID: CVE-2018-4344
vendorProject: Apple
product: Multiple Products
vulnerabilityName: Apple Multiple Products Memory Corruption Vulnerability
dateAdded: 2022-06-27
shortDescription: Apple iOS, macOS, tvOS, and watchOS contain a memory corruption vulnerability which can allow for code execution.
requiredAction: Apply updates per vendor instructions.
dueDate: 2022-07-18
knownRansomwareCampaignUse: Unknown
notes: https://nvd.nist.gov/vuln/detail/CVE-2018-4344
cwes: CWE-119