deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12958
Published: 2024-12-26
Description: A vulnerability classified as critical has been found in 1000 Projects Portfolio Management System MCA 1.0. This affects an unknown part of the file /update_pro_details.php. The manipulation of the argument q leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README6.md; https://vuldb.com/?ctiid.289323
CVE: CVE-2024-12959
Published: 2024-12-26
Description: A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /update_personal_details.php. The manipulation of the argument q leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README7.md; https://vuldb.com/?ctiid.289324
CVE: CVE-2024-51540
Published: 2024-12-26
Description: Dell ECS, versions prior to 3.8.1.3 contains an arithmetic overflow vulnerability exists in retention period handling of ECS. An authenticated user with bucket or object-level access and the necessary privileges could potentially exploit this vulnerability to bypass retention policies and delete objects.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: https://www.dell.com/support/kbdoc/en-us/000256642/dsa-2024-483-security-update-for-dell-ecs-multiple-vulnerabilities
CVE: CVE-2024-12960
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, has been found in 1000 Projects Portfolio Management System MCA 1.0. This issue affects some unknown processing of the file /update_edu_details.php. The manipulation of the argument q leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README8.md; https://vuldb.com/?ctiid.289325
CVE: CVE-2024-12961
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, was found in 1000 Projects Portfolio Management System MCA 1.0. Affected is an unknown function of the file /update_ach_details.php. The manipulation of the argument q leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README9.md; https://vuldb.com/?ctiid.289326
CVE: CVE-2024-12962
Published: 2024-12-26
Description: A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /_parse/_all_edits.php. The manipulation of the argument skillset leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql5.md; https://vuldb.com/?ctiid.289327
CVE: CVE-2024-54907
Published: 2024-12-26
Description: TOTOLINK A3002R V4.0.0-B20[PII_REDACTED] is vulnerable to Remote Code Execution in /bin/boa via formWsc.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: https://github.com/MnrikSrins/totolink_A3002R_RCE
CVE: CVE-2024-12963
Published: 2024-12-26
Description: A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. Affected by this issue is the function add_xp of the file /_parse/_all_edits.php. The manipulation of the argument job_company leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql6.md; https://vuldb.com/?ctiid.289328
CVE: CVE-2024-12964
Published: 2024-12-26
Description: A vulnerability was found in 1000 Projects Daily College Class Work Report Book 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument user leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/alc9700jmo/CVE/issues/4; https://vuldb.com/?ctiid.289329
CVE: CVE-2024-12965
Published: 2024-12-26
Description: A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /update_ex_detail.php. The manipulation of the argument q leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://1000projects.org/; https://github.com/dawatermelon/CVE/blob/main/Portfolio%20Management%20System%20MCA%20Project/README10.md; https://vuldb.com/?ctiid.289330
CVE: CVE-2024-12966
Published: 2024-12-26
Description: A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as critical. This issue affects the function cn_update of the file /_parse/_all_edits.php. The manipulation of the argument cname/url leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/Viper0617/cve/blob/main/sql-viper.md; https://vuldb.com/?ctiid.289331
CVE: CVE-2024-56510
Published: 2024-12-26
Description: @marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patched to fix that. If you are unable to update the package immediately, disable all HTML tags by setting html: false option in the Marp class constructor.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/marp-team/marp-core/commit/61a1def244d1b6faa8e2c0be97ec0b68cab3ab49; https://github.com/marp-team/marp-core/pull/282; https://github.com/marp-team/marp-core/releases/tag/v3.9.1
CVE: CVE-2024-12967
Published: 2024-12-26
Description: A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. Affected is the function fln_update of the file /_parse/_all_edits.php. The manipulation of the argument fname/lname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/glqt/CVE/blob/main/sql-glqt.md; https://vuldb.com/?ctiid.289332
CVE: CVE-2024-12968
Published: 2024-12-26
Description: A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. Affected by this vulnerability is the function edit_jobpost of the file /_parse/_all_edits.php. The manipulation of the argument jobtype leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/705298066/cve/blob/main/sql-1-kzk.md; https://vuldb.com/?ctiid.289333
CVE: CVE-2024-45600
Published: 2024-12-26
Description: Fields is a GLPI plugin that allows users to add custom fields on GLPI items forms. Prior to 1.21.13, an authenticated user can perform a SQL injection when the plugin is active. The vulnerability is fixed in 1.21.13.
CVSS Score: 7.7 (HIGH)
CWE: CWE-89
References: https://github.com/pluginsGLPI/fields/commit/eb927b0f084ee4ef6c87ab2eb7a15e99369e74ae#diff-a7024a397fba9a026157683da73cc675ec6b73bd900374b3836bcdc76ec7bd5cR1166; https://github.com/pluginsGLPI/fields/security/advisories/GHSA-wwxw-64g6-2992
CVE: CVE-2024-45805
Published: 2024-12-26
Description: OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access control for support information (http://<opencti_domain>/storage/get/support/UUID/UUID.zip), and that the UUID is available to general users using an attached query (logs query). This vulnerability is fixed in 6.3.0.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-285
References: https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-42mm-c8x3-g5q6; https://github.com/OpenCTI-Platform/opencti/security/advisories/GHSA-42mm-c8x3-g5q6
CVE: CVE-2024-53850
Published: 2024-12-26
Description: The Addressing GLPI plugin enables you to create IP reports for visualize IP addresses used and free on a given network.. Starting with 3.0.0 and before 3.0.3, a poor security check allows an unauthenticated attacker to determine whether data exists (by name) in GLPI.
CVSS Score: 8.2 (HIGH)
CWE: CWE-470
References: https://github.com/pluginsGLPI/addressing/commit/b334187a99206abbd7d0bc84f720b0a6e69e92f0; https://github.com/pluginsGLPI/addressing/security/advisories/GHSA-fw42-79gw-7qr9
CVE: CVE-2024-55950
Published: 2024-12-26
Description: Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.216, Tabby terminal emulator contains overly permissive entitlements that are unnecessary for its core functionality and plugin system, creating potential security vulnerabilities. The application currently holds powerful permissions including camera, microphone access, and the ability to access personal folders (Downloads, Documents, etc.) through Apple Events, while also maintaining dangerous entitlements that enable code injection. The concerning entitlements are com.apple.security.cs.allow-dyld-environment-variables and com.apple.security.cs.disable-library-validation. Since Tabby's plugins and themes are NodeJS-based without native libraries or frameworks, and no environment variables are used in the codebase, it is recommended to review and remove at least one of the entitlements (com.apple.security.cs.disable-library-validation or com.apple.security.cs.allow-dyld-environment-variables) to prevent DYLD_INSERT_LIBRARIES injection while maintaining full application functionality. This vulnerability is fixed in 1.0.216.
CWE: CWE-276
References: https://github.com/Eugeny/tabby/commit/e1e6e1cdab0310a881e36afd7c2744e5f905518b; https://github.com/Eugeny/tabby/security/advisories/GHSA-jx33-9jc7-24gc; https://github.com/Eugeny/tabby/security/advisories/GHSA-jx33-9jc7-24gc
CVE: CVE-2024-56361
Published: 2024-12-26
Description: LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon crawling the malicious /info endpoint with our payload, will render our javascript on the info page. This information is being displayed via lgsl_details.php. This vulnerability is fixed in 7.0.0.
CWE: CWE-79
References: https://github.com/tltneon/lgsl/commit/3fbd3bb581b636f7fd3ea0592c5f8df87d3a2843; https://github.com/tltneon/lgsl/security/advisories/GHSA-xx95-62h6-h7v3; https://github.com/tltneon/lgsl/security/advisories/GHSA-xx95-62h6-h7v3
CVE: CVE-2024-12969
Published: 2024-12-26
Description: A vulnerability, which was classified as critical, has been found in code-projects Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://code-projects.org/; https://github.com/Rocky-Bull/myCVE/blob/main/Hospital_Management_System_SQLi.md; https://vuldb.com/?ctiid.289334
CVE: CVE-2024-12976
Published: 2024-12-27
Description: A vulnerability, which was classified as critical, has been found in CodeZips Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /staff.php. The manipulation of the argument tel leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/nexus-wkx/CVE/blob/main/SQL_Injection_in_Hospital_Management_System.md; https://vuldb.com/?ctiid.289352; https://vuldb.com/?id.289352
CVE: CVE-2024-12977
Published: 2024-12-27
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Complaint Management System 1.0. This affects an unknown part of the file /admin/state.php. The manipulation of the argument state leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/AngrySheep2003/cve/blob/main/Complaint_Management_System_SQL_Injection.md; https://phpgurukul.com/; https://vuldb.com/?ctiid.289353
CVE: CVE-2024-9774
Published: 2024-12-27
Description: A vulnerability was found in python-sql where unary operators do not escape non-Expression.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-150
References: https://access.redhat.com/security/cve/CVE-2024-9774; https://bugzilla.redhat.com/show_bug.cgi?id=2332734; https://discuss.tryton.org/t/security-release-for-issue-93/7889/3
CVE: CVE-2024-12978
Published: 2024-12-27
Description: A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as critical. This vulnerability affects the function add_req of the file /_parse/_all_edits.php. The manipulation of the argument jid/limit leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql7.md; https://vuldb.com/?ctiid.289354
CVE: CVE-2024-12979
Published: 2024-12-27
Description: A vulnerability was found in code-projects Job Recruitment 1.0 and classified as problematic. This issue affects the function cn_update of the file /_parse/_all_edits.php. The manipulation of the argument cname leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/705298066/cve/blob/main/xss-1.md; https://vuldb.com/?ctiid.289355
CVE: CVE-2024-12980
Published: 2024-12-27
Description: A vulnerability was found in code-projects Job Recruitment 1.0. It has been classified as problematic. Affected is the function fln_update of the file /_parse/_all_edits.php. The manipulation of the argument fname/lname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/705298066/cve/blob/main/xss-2.md; https://vuldb.com/?ctiid.289356
CVE: CVE-2024-56519
Published: 2024-12-27
Description: An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://github.com/tecnickcom/TCPDF/commit/c9f41cbb84880bdb4fc3e0a9d287214d1ac4d7f4; https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0; https://tcpdf.org
CVE: CVE-2024-56520
Published: 2024-12-27
Description: An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.
CVSS Score: 7.3 (HIGH)
References: https://github.com/tecnickcom/TCPDF/commit/a0a02efe487cc39bd5223359e916dbeafb5cd6fe; https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0; https://github.com/tecnickcom/tc-lib-pdf-font/commit/30012e333ae611c514ec2dc7cb370bbf4da4e677
CVE: CVE-2024-56521
Published: 2024-12-27
Description: An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295, CWE-295
References: https://github.com/tecnickcom/TCPDF/commit/aab43ab0a824e956276141a28a24c7c0be20f554; https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0; https://tcpdf.org
CVE: CVE-2024-56522
Published: 2024-12-27
Description: An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843
References: https://github.com/tecnickcom/TCPDF/commit/d54b97cec33f4f1a5ad81119a82085cad93cec89; https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0; https://tcpdf.org
CVE: CVE-2024-11605
Published: 2024-12-27
Description: The wp-publications WordPress plugin through 1.2 does not escape filenames before outputting them back in the page, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/91c5ee70-2ff5-46cd-a0f5-54987fc2e060/; https://wpscan.com/vulnerability/91c5ee70-2ff5-46cd-a0f5-54987fc2e060/
CVE: CVE-2024-11644
Published: 2024-12-27
Description: The WP-SVG WordPress plugin through 0.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5b6a80f1-369c-4dd2-877e-60b724084819/; https://wpscan.com/vulnerability/5b6a80f1-369c-4dd2-877e-60b724084819/
CVE: CVE-2024-11645
Published: 2024-12-27
Description: The float block WordPress plugin through 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7771a76b-bc8c-426f-a125-5bd74ccf2845/; https://wpscan.com/vulnerability/7771a76b-bc8c-426f-a125-5bd74ccf2845/
CVE: CVE-2024-11842
Published: 2024-12-27
Description: The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/2545f054-b6ca-4ee5-ac6f-f42193db21b1/; https://wpscan.com/vulnerability/2545f054-b6ca-4ee5-ac6f-f42193db21b1/
CVE: CVE-2024-11921
Published: 2024-12-27
Description: The GiveWP  WordPress plugin before 3.19.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/5f196294-5ba9-45b6-a27c-ab1702cc001f/; https://wpscan.com/vulnerability/5f196294-5ba9-45b6-a27c-ab1702cc001f/
CVE: CVE-2024-12981
Published: 2024-12-27
Description: A vulnerability was found in CodeAstro Car Rental System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /bookingconfirm.php. The manipulation of the argument driver_id_from_dropdown leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://codeastro.com/; https://github.com/CharilYang/cve/issues/1; https://vuldb.com/?ctiid.289357
CVE: CVE-2024-12982
Published: 2024-12-27
Description: A vulnerability was found in PHPGurukul Blood Bank & Donor Management System 2.4. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /bbdms/admin/update-contactinfo.php. The manipulation of the argument Address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://phpgurukul.com/; https://vuldb.com/?ctiid.289358; https://vuldb.com/?id.289358
CVE: CVE-2024-56527
Published: 2024-12-27
Description: An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-79, CWE-79
References: https://andrea0.medium.com/analysis-of-cve-2024-56527-dbdab6962add; https://github.com/tecnickcom/TCPDF/commit/11778aaa2d9e30a9ae1c1ee97ff349344f0ad6e1; https://github.com/tecnickcom/TCPDF/compare/6.7.8...6.8.0
CVE: CVE-2024-12983
Published: 2024-12-27
Description: A vulnerability classified as problematic has been found in code-projects Hospital Management System 1.0. This affects an unknown part of the file /hospital/hms/admin/manage-doctors.php of the component Edit Doctor Details Page. The manipulation of the argument Doctor Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://code-projects.org/; https://github.com/Rocky-Bull/myCVE/blob/main/Hospital_Management_System_XSS.md; https://vuldb.com/?ctiid.289359
CVE: CVE-2020-1818
Published: 2024-12-27
Description: There are multiple out of bounds (OOB) read vulnerabilities in the implementation of the Common Open Policy Service (COPS) protocol of some Huawei products. The specific decoding function may occur out-of-bounds read when processes an incoming data packet. Successful exploit of these vulnerabilities may disrupt service on the affected device. (Vulnerability ID: HWPSIRT-2018-12275,HWPSIRT-2018-12276,HWPSIRT-2018-12277,HWPSIRT-2018-12278,HWPSIRT-2018-12279,HWPSIRT-2018-12280 and HWPSIRT-2018-12289)

The seven vulnerabilities have been assigned seven Common Vulnerabilities and Exposures (CVE) IDs: CVE-2020-1818, CVE-2020-1819, CVE-2020-1820, CVE-2020-1821, CVE-2020-1822, CVE-2020-1823 and CVE-2020-1824.
CVSS Score: 3.7 (LOW)
CWE: CWE-125, CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/2020/huawei-sa-20191218-01-cops-en