deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-18905
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-613
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18906
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18907
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18908
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18913
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18914
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18915
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18916
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-732
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18917
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18918
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-295
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18919
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18920
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
CVSS Score: 9.8 (CRITICAL)
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2017-18921
Published: 2020-06-19
Description: An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://mattermost.com/security-updates/; https://mattermost.com/security-updates/
CVE: CVE-2020-10750
Published: 2020-06-19
Description: Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200, CWE-532, CWE-532
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10750; https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10750
CVE: CVE-2019-20891
Published: 2020-06-19
Description: WooCommerce before 3.6.5, when it handles CSV imports of products, has a cross-site request forgery (CSRF) issue with resultant stored cross-site scripting (XSS) via includes/admin/importers/class-wc-product-csv-importer-controller.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss/; https://raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt; https://blog.ripstech.com/2019/woocommerce-csrf-to-stored-xss/
CVE: CVE-2020-14930
Published: 2020-06-19
Description: An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client.
CVSS Score: 8.1 (HIGH)
CWE: CWE-319, CWE-522
References: https://www.exploit-db.com/exploits/48196; https://www.pentest.com.tr/exploits/CTROMS-Terminal-OS-Port-Portal-Password-Reset-Authentication-Bypass.html; https://www.exploit-db.com/exploits/48196
CVE: CVE-2020-13262
Published: 2020-06-19
Description: Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-74
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13262.json; https://gitlab.com/gitlab-org/gitlab/-/issues/211949; https://hackerone.com/reports/824689
CVE: CVE-2020-13265
Published: 2020-06-19
Description: User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13265.json; https://gitlab.com/gitlab-org/gitlab/-/issues/121664; https://hackerone.com/reports/762568
CVE: CVE-2020-13272
Published: 2020-06-19
Description: OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow
CVSS Score: 7.5 (HIGH)
CWE: CWE-345
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13272.json; https://gitlab.com/gitlab-org/gitlab/-/issues/37038; https://hackerone.com/reports/743556
CVE: CVE-2020-13273
Published: 2020-06-19
Description: A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1
CVSS Score: 7.5 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13273.json; https://gitlab.com/gitlab-org/gitlab/-/issues/207349; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13273.json
CVE: CVE-2020-13274
Published: 2020-06-19
Description: A security issue allowed achieving Denial of Service attacks through memory exhaustion by uploading malicious artifacts in all previous GitLab versions through 13.0.1
CVSS Score: 7.5 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13274.json; https://gitlab.com/gitlab-org/gitlab/-/issues/14195; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13274.json
CVE: CVE-2020-13275
Published: 2020-06-19
Description: A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1
CVSS Score: 8.0 (HIGH)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13275.json; https://gitlab.com/gitlab-org/gitlab/-/issues/209254; https://hackerone.com/reports/806255
CVE: CVE-2020-13276
Published: 2020-06-19
Description: User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1
CVSS Score: 7.4 (HIGH)
CWE: CWE-862
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13276.json; https://gitlab.com/gitlab-org/gitlab/-/issues/25994; https://hackerone.com/reports/471907
CVE: CVE-2020-14931
Published: 2020-06-19
Description: A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nic_format_buff.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/jaygreig86/dmitry/issues/4; https://github.com/jaygreig86/dmitry/issues/4; https://lists.debian.org/debian-lts-announce/2024/10/msg00024.html
CVE: CVE-2020-13261
Published: 2020-06-19
Description: Amazon EKS credentials disclosure in GitLab CE/EE 12.6 and later through 13.0.1 allows other administrators to view Amazon EKS credentials via HTML source code
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13261.json; https://gitlab.com/gitlab-org/gitlab/-/issues/199242; https://hackerone.com/reports/784130
CVE: CVE-2020-13263
Published: 2020-06-19
Description: An authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could allow unauthorized users to impersonate as a maintainer to perform limited actions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13263.json; https://gitlab.com/gitlab-org/gitlab/-/issues/211940; https://hackerone.com/reports/819821
CVE: CVE-2020-13264
Published: 2020-06-19
Description: Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13264.json; https://gitlab.com/gitlab-org/gitlab/-/issues/55302; https://hackerone.com/reports/702796
CVE: CVE-2020-14932
Published: 2020-06-20
Description: compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://www.openwall.com/lists/oss-security/2020/06/20/1; https://www.openwall.com/lists/oss-security/2020/06/20/1
CVE: CVE-2020-14933
Published: 2020-06-20
Description: compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. NOTE: the vendor disputes this because these two conditions for PHP object injection are not satisfied: existence of a PHP magic method (such as __wakeup or __destruct), and any attack-relevant classes must be declared before unserialize is called (or must be autoloaded).
CVSS Score: 8.8 (HIGH)
CWE: CWE-502
References: https://www.openwall.com/lists/oss-security/2020/06/20/1; https://www.openwall.com/lists/oss-security/2020/06/20/1
CVE: CVE-2020-14942
Published: 2020-06-21
Description: Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/tendenci/tendenci/issues/867; https://github.com/tendenci/tendenci/issues/867
CVE: CVE-2020-14950
Published: 2020-06-21
Description: aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request (start, stop, or restart) to the setting menu of Sotfware Store.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/jenaye/aapanel; https://github.com/jenaye/aapanel
CVE: CVE-2020-14954
Published: 2020-06-21
Description: Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74
References: http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20200615/000023.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00064.html; http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00070.html
CVE: CVE-2020-14958
Published: 2020-06-21
Description: In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: https://github.com/gogs/gogs/commit/82ff0c5852f29daa5f95d965fd50665581e7ea3c; https://github.com/gogs/gogs/pull/5988; https://github.com/gogs/gogs/commit/82ff0c5852f29daa5f95d965fd50665581e7ea3c
CVE: CVE-2020-14467
Published: 2020-06-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-14959
Published: 2020-06-22
Description: Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/10223; https://wpvulndb.com/vulnerabilities/10223
CVE: CVE-2020-14960
Published: 2020-06-22
Description: A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter,
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/php-fusion/PHP-Fusion/commit/b3bde37f60e96f1a8ddd[PII_REDACTED]b28be77db5; https://github.com/php-fusion/PHP-Fusion/issues/2327; https://www.exploit-db.com/exploits/48487
CVE: CVE-2020-14961
Published: 2020-06-22
Description: Concrete5 before 8.5.3 does not constrain the sort direction to a valid asc or desc value.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/concrete5/concrete5/pull/8651; https://github.com/concrete5/concrete5/releases/tag/8.5.3; https://github.com/concrete5/concrete5/pull/8651
CVE: CVE-2020-14962
Published: 2020-06-22
Description: Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpvulndb.com/vulnerabilities/10241; https://wpvulndb.com/vulnerabilities/10241
CVE: CVE-2019-10597
Published: 2020-06-22
Description: kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, MSM8996, MSM8996AU, Nicobar, QCS605, Rennell, Saipan, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-10626
Published: 2020-06-22
Description: Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Rennell, Saipan, SC8180X, SDA660, SDA845, SDM429W, SDM439, SDM670, SDM710, SDX20, SDX24, SDX55, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-14047
Published: 2020-06-22
Description: While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8096AU, MDM9607, MSM8909W, MSM8996, MSM8996AU, QCN7605, QCS605, SC8180X, SDA845, SDX20, SDX24, SDX55, SM8150, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-14062
Published: 2020-06-22
Description: Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SA415M, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-14073
Published: 2020-06-22
Description: Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow when processing large data or non-standard feedback messages in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SA415M, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-14076
Published: 2020-06-22
Description: Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8998, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-14080
Published: 2020-06-22
Description: Out of bound write can happen due to lack of check of array index value while parsing SDP attribute for SAR in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, Kamorta, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCM2150, QCS605, QM215, Rennell, SA415M, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-14091
Published: 2020-06-22
Description: Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, QCS405, Rennell, Saipan, SC8180X, SDX55, SM8150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-415, CWE-667
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin
CVE: CVE-2019-14092
Published: 2020-06-22
Description: System Services exports services without permission protect and can lead to information exposure in Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9207C, MDM9607, Rennell, Saipan, SM8150, SM8250, SXR2130
CVSS Score: 5.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/june-2020-bulletin