deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3175
Published: 2020-02-26
Description: A vulnerability in the resource handling system of Cisco NX-OS Software for Cisco MDS 9000 Series Multilayer Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource usage control. An attacker could exploit this vulnerability by sending traffic to the management interface (mgmt0) of an affected device at very high rates. An exploit could allow the attacker to cause unexpected behaviors such as high CPU usage, process crashes, or even full system reboots of an affected device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-664, CWE-400
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-mds-ovrld-dos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-mds-ovrld-dos
CVE: CVE-2019-17274
Published: 2020-02-26
Description: NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1188
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-17275
Published: 2020-02-26
Description: OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
CVSS Score: 9.8 (CRITICAL)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-18238
Published: 2020-02-26
Description: In Moxa ioLogik 2500 series firmware, Version 3.0 or lower, and IOxpress configuration utility, Version 2.3.0 or lower, sensitive information is stored in configuration files without encryption, which may allow an attacker to access an administrative account.
CVSS Score: 7.5 (HIGH)
CWE: CWE-312, CWE-312
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-02; https://www.us-cert.gov/ics/advisories/icsa-20-056-02
CVE: CVE-2015-5686
Published: 2020-02-27
Description: Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-1021
References: https://puppet.com/security/cve/CVE-2015-5686/; https://puppet.com/security/cve/CVE-2015-5686/
CVE: CVE-2017-5861
Published: 2020-02-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2[PII_REDACTED]. Reason: This candidate is a reservation duplicate of CVE-2[PII_REDACTED]. Notes: All CVE users should reference CVE-2[PII_REDACTED] instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-3923
Published: 2020-02-27
Description: DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default password and gain access to the system.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910003; https://www.chtsecurity.com/news/4ef5eb3a-fdc3-4d78-8dd7-ec7213e2bbcf; https://tvn.twcert.org.tw/taiwanvn/TVN-201910003
CVE: CVE-2020-3924
Published: 2020-02-27
Description: DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-77
References: https://tvn.twcert.org.tw/taiwanvn/TVN-201910004; https://www.chtsecurity.com/news/4ef5eb3a-fdc3-4d78-8dd7-ec7213e2bbcf; https://tvn.twcert.org.tw/taiwanvn/TVN-201910004
CVE: CVE-2017-6363
Published: 2020-02-27
Description: In the GD Graphics Library (aka LibGD) through 2.2.5, there is a heap-based buffer over-read in tiffWriter in gd_tiff.c. NOTE: the vendor says "In my opinion this issue should not have a CVE, since the GD and GD2 formats are documented to be 'obsolete, and should only be used for development and testing purposes.'
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: https://github.com/libgd/libgd/issues/383; https://github.com/libgd/libgd/issues/383
CVE: CVE-2017-6371
Published: 2020-02-27
Description: Synchronet BBS 3.16c for Windows allows remote attackers to cause a denial of service (service crash) via a long string in the HTTP Referer header.
CVSS Score: 7.5 (HIGH)
References: http://packetstormsecurity.com/files/141396/Synchronet-BBS-3.16c-For-Windows-Denial-Of-Service.html; https://www.exploit-db.com/exploits/41475/; http://packetstormsecurity.com/files/141396/Synchronet-BBS-3.16c-For-Windows-Denial-Of-Service.html
CVE: CVE-2018-19668
Published: 2020-02-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-17963. Reason: This candidate is a reservation duplicate of CVE-2018-17963. Notes: All CVE users should reference CVE-2018-17963 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2019-12882
Published: 2020-02-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2019-4669
Published: 2020-02-27
Description: IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 through 8.6.0.0 CF2018.03, and IBM Business Automation Workflow 18.0.0.1 through 19.0.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171254.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171254; https://www.ibm.com/support/pages/node/3552261; https://exchange.xforce.ibmcloud.com/vulnerabilities/171254
CVE: CVE-2019-5323
Published: 2020-02-27
Description: There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sanitized before being parsed by AirWave. If conditions are met, an attacker can obtain command execution on the host.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-002.txt
CVE: CVE-2019-5326
Published: 2020-02-27
Description: An administrative application user of or application user with write access to Aruba Airwave VisualRF is able to obtain code execution on the AMP platform. This is possible due to the ability to overwrite a file on disk which is subsequently deserialized by the Java application component.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-002.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-002.txt
CVE: CVE-2020-6863
Published: 2020-02-27
Description: ZTE E8820V3 router product is impacted by a permission and access control vulnerability. Attackers could use this vulnerability to tamper with DDNS parameters and send DoS attacks on the specified URL.
CVSS Score: 6.5 (MEDIUM)
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012382; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012382
CVE: CVE-2020-6864
Published: 2020-02-27
Description: ZTE E8820V3 router product is impacted by an information leak vulnerability. Attackers could use this vulnerability to to gain wireless passwords. After obtaining the wireless password, the attacker could collect information and attack the router.
CVSS Score: 6.5 (MEDIUM)
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012382; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1012382
CVE: CVE-2015-2992
Published: 2020-02-27
Description: Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN88408929/index.html; http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000124.html; http://www.securityfocus.com/bid/76624
CVE: CVE-2017-16900
Published: 2020-02-27
Description: Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the local user to access other user's information which is unauthorized via brute force.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-307
References: http://hunesion.com; http://i-onenet.com; https://github.com/summtime/CVE/tree/master/CVE-2017-16900
CVE: CVE-2020-7041
Published: 2020-02-27
Description: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because an X509_check_host negative error code is interpreted as a successful return value.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html; https://github.com/adrienverge/openfortivpn/commit/60660e00b80bad0fadcf39aee86f6f8756c94f91
CVE: CVE-2020-7042
Published: 2020-02-27
Description: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL 1.0.2 or later. tunnel.c mishandles certificate validation because the hostname check operates on uninitialized memory. The outcome is that a valid certificate is never accepted (only a malformed certificate may be accepted).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-295, CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html; https://github.com/adrienverge/openfortivpn/commit/9eee997d599a89492281fc7ffdd79d88cd61afc3
CVE: CVE-2020-7043
Published: 2020-02-27
Description: An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname comparisons do not consider '\0' characters, as demonstrated by a good.example.com\x00evil.example.com attack.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00011.html; https://github.com/adrienverge/openfortivpn/commit/6328a070ddaab16faaf008cb9a8a62439c30f2a8
CVE: CVE-2020-5400
Published: 2020-02-27
Description: Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-532
References: https://www.cloudfoundry.org/blog/cve-2020-5400; https://www.cloudfoundry.org/blog/cve-2020-5400
CVE: CVE-2020-5401
Published: 2020-02-27
Description: Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-393, CWE-444
References: https://www.cloudfoundry.org/blog/cve-2020-5401; https://www.cloudfoundry.org/blog/cve-2020-5401
CVE: CVE-2020-5402
Published: 2020-02-27
Description: In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.cloudfoundry.org/blog/cve-2020-5402; https://www.cloudfoundry.org/blog/cve-2020-5402
CVE: CVE-2020-3825
Published: 2020-02-27
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, tvOS 13.3.1, Safari 13.0.5, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210947; https://support.apple.com/HT210948; https://support.apple.com/HT210947
CVE: CVE-2020-3826
Published: 2020-02-27
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT210947; https://support.apple.com/HT210948; https://support.apple.com/HT210947
CVE: CVE-2020-3827
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.3. Viewing a maliciously crafted JPEG file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210919; https://support.apple.com/HT210919
CVE: CVE-2020-3828
Published: 2020-02-27
Description: A lock screen issue allowed access to contacts on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A person with physical access to an iOS device may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/HT210918; https://support.apple.com/HT210918
CVE: CVE-2020-3829
Published: 2020-02-27
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3830
Published: 2020-02-27
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to overwrite arbitrary files.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: https://support.apple.com/HT210919; https://support.apple.com/HT210919
CVE: CVE-2020-3831
Published: 2020-02-27
Description: A race condition was addressed with improved locking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://support.apple.com/HT210918; https://support.apple.com/HT210918
CVE: CVE-2020-3833
Published: 2020-02-27
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in Safari 13.0.5. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/HT210922; https://support.apple.com/HT210922
CVE: CVE-2020-3834
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210921; https://support.apple.com/HT210921
CVE: CVE-2020-3835
Published: 2020-02-27
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to access restricted files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: https://support.apple.com/HT210919; https://support.apple.com/HT210919
CVE: CVE-2020-3836
Published: 2020-02-27
Description: An access issue was addressed with improved memory management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to determine kernel memory layout.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3837
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3838
Published: 2020-02-27
Description: The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://seclists.org/fulldisclosure/2021/Apr/51; https://support.apple.com/HT210918; https://support.apple.com/HT210919
CVE: CVE-2020-3839
Published: 2020-02-27
Description: A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.3. An application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/HT210919; https://support.apple.com/HT210919
CVE: CVE-2020-3840
Published: 2020-02-27
Description: An off by one issue existed in the handling of racoon configuration files. This issue was addressed through improved bounds checking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1. Loading a maliciously crafted racoon configuration file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-193
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3841
Published: 2020-02-27
Description: The issue was addressed with improved UI handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, Safari 13.0.5. A local user may unknowingly send a password unencrypted over the network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319, CWE-522
References: https://support.apple.com/HT210918; https://support.apple.com/HT210922; https://support.apple.com/HT210918
CVE: CVE-2020-3842
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3843
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4.7, watchOS 5.3.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/162119/iOS-macOS-Radio-Proximity-Kernel-Memory-Corruption.html; https://support.apple.com/HT211169; https://support.apple.com/HT211176
CVE: CVE-2020-3844
Published: 2020-02-27
Description: This issue was addressed with improved checks. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. Users removed from an iMessage conversation may still be able to alter state.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/HT210918; https://support.apple.com/HT210918
CVE: CVE-2020-3845
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210919; https://support.apple.com/HT210919
CVE: CVE-2020-3846
Published: 2020-02-27
Description: A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2, iTunes for Windows 12.10.4, iCloud for Windows 11.0, iCloud for Windows 7.17. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-119
References: https://support.apple.com/HT210947; https://support.apple.com/HT210948; https://support.apple.com/HT210947
CVE: CVE-2020-3853
Published: 2020-02-27
Description: A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-843
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3854
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.3. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210919; https://support.apple.com/HT210919
CVE: CVE-2020-3856
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. Processing a maliciously crafted string may lead to heap corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3857
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210918; https://support.apple.com/HT210919; https://support.apple.com/HT210920
CVE: CVE-2020-3858
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210918; https://support.apple.com/HT210918
CVE: CVE-2020-3859
Published: 2020-02-27
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. A person with physical access to an iOS device may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/HT210918; https://support.apple.com/HT210918
CVE: CVE-2020-3860
Published: 2020-02-27
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, watchOS 6.1.2. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://support.apple.com/HT210918; https://support.apple.com/HT210921; https://support.apple.com/HT210918
CVE: CVE-2020-3861
Published: 2020-02-27
Description: The issue was addressed with improved permissions logic. This issue is fixed in iTunes for Windows 12.10.4. A user may gain access to protected parts of the file system.
CVSS Score: 7.1 (HIGH)
References: https://support.apple.com/HT210923; https://support.apple.com/HT210923