deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-13081
Published: 2019-11-06
Description: Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated_tickets.php service desk ticket functionality) that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report; https://www.quest.com/products/kace-systems-management-appliance/; https://support.quest.com/kb/311388/quest-response-to-certezza-vulnerability-report
CVE: CVE-2015-7276
Published: 2019-11-06
Description: Technicolor C2000T and C2100T uses hard-coded cryptographic keys.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: http://www.kb.cert.org/vuls/id/566724; https://sec-consult.com/en/blog/2015/11/house-of-keys-industry-wide-https/; http://www.kb.cert.org/vuls/id/566724
CVE: CVE-2017-18639
Published: 2019-11-06
Description: Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title, /Content/Images/LibraryImages/newsimages Parameter : Image Title, /Content/links Parameter : Link Title, /Content/links Parameter : Link Title, or /Content/Videos/LibraryVideos/default-video-library Parameter : Video Title.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/42792; https://www.exploit-db.com/exploits/42792
CVE: CVE-2019-18797
Published: 2019-11-06
Description: LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-674
References: https://github.com/sass/libsass/issues/3000; https://github.com/sass/libsass/issues/3000
CVE: CVE-2019-18798
Published: 2019-11-06
Description: LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in ast_sel_weave.cpp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/sass/libsass/issues/2999; https://github.com/sass/libsass/issues/2999
CVE: CVE-2019-18799
Published: 2019-11-06
Description: LibSass before 3.6.3 allows a NULL pointer dereference in Sass::Parser::parseCompoundSelector in parser_selectors.cpp.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/sass/libsass/issues/3001; https://github.com/sass/libsass/issues/3001
CVE: CVE-2019-18800
Published: 2019-11-06
Description: Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 20 bytes of udid in a binary format, which is located at offset 0x14 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS.
CVSS Score: 8.8 (HIGH)
CWE: CWE-311, CWE-319
References: https://thesamarkand.tumblr.com/post/[PII_REDACTED]9/viber-messenger-remote-account-reset-0day; https://thesamarkand.tumblr.com/post/[PII_REDACTED]9/viber-messenger-remote-account-reset-0day
CVE: CVE-2010-2247
Published: 2019-11-06
Description: makepasswd 1.10 default settings generate insecure passwords
CVSS Score: 7.5 (HIGH)
CWE: CWE-1188
References: https://access.redhat.com/security/cve/cve-2010-2247; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HLHAXN3XRR7RJ73SJTBSW3GZT4GLHI33/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JLAGK43ZTRNAMRO7JI2AW4BAZS35QSEE/
CVE: CVE-2010-2446
Published: 2019-11-06
Description: Rbot Reaction plugin allows command execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://security-tracker.debian.org/tracker/CVE-2010-2446; https://www.securityfocus.com/archive/1/509719/30/0/threaded; https://security-tracker.debian.org/tracker/CVE-2010-2446
CVE: CVE-2011-4626
Published: 2019-11-06
Description: Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow" property of the typolink function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security-tracker.debian.org/tracker/CVE-2011-4626; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSS; https://security-tracker.debian.org/tracker/CVE-2011-4626
CVE: CVE-2011-4627
Published: 2019-11-06
Description: TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://security-tracker.debian.org/tracker/CVE-2011-4627; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#Information_Disclosure; https://security-tracker.debian.org/tracker/CVE-2011-4627
CVE: CVE-2011-4628
Published: 2019-11-06
Description: TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://security-tracker.debian.org/tracker/CVE-2011-4628; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#Authentication_Delay_Bypass; https://security-tracker.debian.org/tracker/CVE-2011-4628
CVE: CVE-2011-4629
Published: 2019-11-06
Description: Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security-tracker.debian.org/tracker/CVE-2011-4629; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSS; https://security-tracker.debian.org/tracker/CVE-2011-4629
CVE: CVE-2011-4630
Published: 2019-11-06
Description: Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links wizard.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security-tracker.debian.org/tracker/CVE-2011-4630; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSS; https://security-tracker.debian.org/tracker/CVE-2011-4630
CVE: CVE-2011-4631
Published: 2019-11-06
Description: Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system extension recycler.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security-tracker.debian.org/tracker/CVE-2011-4631; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSS; https://security-tracker.debian.org/tracker/CVE-2011-4631
CVE: CVE-2011-4632
Published: 2019-11-06
Description: Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash message.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://security-tracker.debian.org/tracker/CVE-2011-4632; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSS; https://security-tracker.debian.org/tracker/CVE-2011-4632
CVE: CVE-2011-4900
Published: 2019-11-06
Description: TYPO3 before 4.5.4 allows Information Disclosure in the backend.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://security-tracker.debian.org/tracker/CVE-2011-4900; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#Information_Disclosure; https://security-tracker.debian.org/tracker/CVE-2011-4900
CVE: CVE-2011-4901
Published: 2019-11-06
Description: TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://security-tracker.debian.org/tracker/CVE-2011-4901; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#Information_Disclosure; https://security-tracker.debian.org/tracker/CVE-2011-4901
CVE: CVE-2011-4902
Published: 2019-11-06
Description: TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://security-tracker.debian.org/tracker/CVE-2011-4902; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#Unserialize; https://security-tracker.debian.org/tracker/CVE-2011-4902
CVE: CVE-2011-4903
Published: 2019-11-06
Description: Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://security-tracker.debian.org/tracker/CVE-2011-4903; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#XSS; https://security-tracker.debian.org/tracker/CVE-2011-4903
CVE: CVE-2011-4904
Published: 2019-11-06
Description: TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://security-tracker.debian.org/tracker/CVE-2011-4904; https://typo3.org/security/advisory/typo3-core-sa-2011-001/#Missing_Access_Control; https://security-tracker.debian.org/tracker/CVE-2011-4904
CVE: CVE-2019-10488
Published: 2019-11-06
Description: Null pointer dereference can occur while parsing invalid chunks while playing the nonstandard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10491
Published: 2019-11-06
Description: ADSP can be compromised since it`s a general-purpose CPU processing untrusted data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10495
Published: 2019-11-06
Description: Arbitrary buffer write issue while processing sequence header during HEVC or AVC encoding. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 7.3 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10496
Published: 2019-11-06
Description: Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10502
Published: 2019-11-06
Description: Possible stack overflow when an index equal to io buffer size is accessed in camera module in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 845 / SD 850, SD 855, SDM439, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/; https://www.qualcomm.com/company/product-security/bulletins/september-2019-bulletin; https://source.android.com/security/bulletin/
CVE: CVE-2019-10504
Published: 2019-11-06
Description: Firmware not able to send EXT scan response to host within 1 sec due to resource consumption issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10505
Published: 2019-11-06
Description: Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10512
Published: 2019-11-06
Description: Payload size is not checked before using it as array index in audio in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10515
Published: 2019-11-06
Description: DCI client which might be preemptively freed up might be accessed for transferring packets leading to kernel error in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10522
Published: 2019-11-06
Description: While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10524
Published: 2019-11-06
Description: Lack of check for a negative value returned for get_clk is wrongly interpreted as valid pointer and lead to use after free in clk driver in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10528
Published: 2019-11-06
Description: Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10529
Published: 2019-11-06
Description: Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10531
Published: 2019-11-06
Description: Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10533
Published: 2019-11-06
Description: Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10534
Published: 2019-11-06
Description: Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10541
Published: 2019-11-06
Description: Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-908
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/
CVE: CVE-2019-10542
Published: 2019-11-06
Description: Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://source.android.com/security/bulletin/; https://source.android.com/security/bulletin/