deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8956
Published: 2020-10-27
Description: Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
CVSS Score: 3.3 (LOW)
CWE: CWE-521
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
CVE: CVE-2020-7753
Published: 2020-10-27
Description: All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/component/trim/blob/master/index.js%23L6; https://lists.apache.org/thread.html/r10faad1ef9166d37a1a5c9142b1af7099b8ecdc5ad05c51b8ea993d9%40%3Ccommits.airflow.apache.org%3E; https://lists.apache.org/thread.html/r51ff3c2a4c7b8402f321eae7e624672cc2295c7bc8c12c8b871f6b0b%40%3Ccommits.airflow.apache.org%3E
CVE: CVE-2020-10256
Published: 2020-10-27
Description: An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to perform brute-force calculations of encryption keys and thus succeed at decryption.
CVSS Score: 9.8 (CRITICAL)
References: https://support.1password.com/command-line/; https://support.1password.com/kb/202010/; https://support.1password.com/scim/
CVE: CVE-2020-23864
Published: 2020-10-27
Description: An issue exits in IOBit Malware Fighter version 8.0.2.547. Local escalation of privileges is possible by dropping a malicious DLL file into the WindowsApps folder.
CVSS Score: 7.8 (HIGH)
References: http://daniels-it-blog.blogspot.com/2020/07/iobit-malware-fighter-arbitrary-code.html; http://daniels-it-blog.blogspot.com/2020/07/iobit-malware-fighter-arbitrary-code.html
CVE: CVE-2020-6022
Published: 2020-10-27
Description: Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-275
References: https://www.zonealarm.com/software/extreme-security/release-history; https://www.zonealarm.com/software/extreme-security/release-history
CVE: CVE-2020-6023
Published: 2020-10-27
Description: Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to escalate privileges while restoring files in Anti-Ransomware.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://www.zonealarm.com/software/extreme-security/release-history; https://www.zonealarm.com/software/extreme-security/release-history
CVE: CVE-2020-8579
Published: 2020-10-27
Description: Clustered Data ONTAP versions 9.7 through 9.7P7 are susceptible to a vulnerability which allows an attacker with access to an intercluster LIF to cause a Denial of Service (DoS).
CVSS Score: 7.5 (HIGH)
References: https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]; https://security.netapp.com/advisory/NTAP-20[PII_REDACTED]
CVE: CVE-2020-23945
Published: 2020-10-27
Description: A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/VictorAlagwu/CMSsite/issues/14; https://github.com/VictorAlagwu/CMSsite/issues/14
CVE: CVE-2020-7754
Published: 2020-10-27
Description: This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
CVSS Score: 7.5 (HIGH)
References: https://github.com/npm/npm-user-validate/commit/c8a87dac1a4cc6988b5418f30411a8669bef204e; https://github.com/npm/npm-user-validate/security/advisories/GHSA-xgh6-85xh-479p; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019353
CVE: CVE-2020-11854
Published: 2020-10-27
Description: Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance Management. The vulneravility affects: 1.) Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. 3.) Application Performance Management versions 9,51, 9.50 and 9.40 with uCMDB 10.33 CUP 3. The vulnerability could allow Arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/161182/Micro-Focus-UCMDB-Remote-Code-Execution.html; https://softwaresupport.softwaregrp.com/doc/KM03747657; https://softwaresupport.softwaregrp.com/doc/KM03747658
CVE: CVE-2020-11858
Published: 2020-10-27
Description: Code execution with escalated privileges vulnerability in Micro Focus products Operation Bridge Manager and Operation Bridge (containerized). The vulneravility affects: 1.) Operation Bridge Manager versions: 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions. 2.) Operations Bridge (containerized) versions: 2020.05, 2019.08, 2019.05, 2018.11, 2018.08, 2018.05. 2018.02 and 2017.11. The vulnerability could allow local attackers to execute code with escalated privileges.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/161411/Micro-Focus-Operations-Bridge-Manager-Local-Privilege-Escalation.html; https://softwaresupport.softwaregrp.com/doc/KM03747658; https://softwaresupport.softwaregrp.com/doc/KM03747854
CVE: CVE-2020-26156
Published: 2020-10-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-27853
Published: 2020-10-27
Description: Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and Signaling) 5.3 through 6.x before 6.4, the Wire Secure Messenger application before 3.49.918 for Android, and the Wire Secure Messenger application before 3.61 for iOS. This occurs via the value parameter to sdp_media_set_lattr in peerflow/sdp.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-134
References: http://github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html; https://github.com/wireapp/wire-audio-video-signaling/issues/23#issuecomment-710075689; http://github.security.telekom.com/2020/11/wire-secure-messenger-format-string-vulnerability.html
CVE: CVE-2020-7755
Published: 2020-10-27
Description: All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/dataarts/dat.gui/issues/278; https://snyk.io/vuln/SNYK-JS-DATGUI-1016275; https://github.com/dataarts/dat.gui/issues/278
CVE: CVE-2020-15238
Published: 2020-10-27
Description: Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the DhcpClient method of the D-Bus interface to blueman-mechanism is prone to an argument injection vulnerability. The impact highly depends on the system configuration. If Polkit-1 is disabled and for versions lower than 2.0.6, any local user can possibly exploit this. If Polkit-1 is enabled for version 2.0.6 and later, a possible attacker needs to be allowed to use the `org.blueman.dhcp.client` action. That is limited to users in the wheel group in the shipped rules file that do have the privileges anyway. On systems with ISC DHCP client (dhclient), attackers can pass arguments to `ip link` with the interface name that can e.g. be used to bring down an interface or add an arbitrary XDP/BPF program. On systems with dhcpcd and without ISC DHCP client, attackers can even run arbitrary scripts by passing `-c/path/to/script` as an interface name. Patches are included in 2.1.4 and master that change the DhcpClient D-Bus method(s) to accept BlueZ network object paths instead of network interface names. A backport to 2.0(.8) is also available. As a workaround, make sure that Polkit-1-support is enabled and limit privileges for the `org.blueman.dhcp.client` action to users that are able to run arbitrary commands as root anyway in /usr/share/polkit-1/rules.d/blueman.rules.
CVSS Score: 7.1 (HIGH)
CWE: CWE-74, CWE-88
References: http://packetstormsecurity.com/files/159740/Blueman-Local-Root-Privilege-Escalation.html; https://bugs.launchpad.net/ubuntu/+source/blueman/+bug/1897287; https://github.com/blueman-project/blueman/releases/tag/2.1.4
CVE: CVE-2018-4296
Published: 2020-10-27
Description: This issue is fixed in macOS Mojave 10.14. A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/HT209139; https://support.apple.com/en-us/HT209139
CVE: CVE-2018-4339
Published: 2020-10-27
Description: This issue was addressed with a new entitlement. This issue is fixed in iOS 12.1. A local user may be able to read a persistent device identifier.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209192; https://support.apple.com/en-us/HT209192
CVE: CVE-2018-4381
Published: 2020-10-27
Description: A resource exhaustion issue was addressed with improved input validation. This issue is fixed in tvOS 12.1, iOS 12.1. Processing a maliciously crafted message may lead to a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: https://support.apple.com/en-us/HT209192; https://support.apple.com/en-us/HT209194; https://support.apple.com/en-us/HT209192
CVE: CVE-2018-4390
Published: 2020-10-27
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, watchOS 4.3, iOS 12.1. Processing a maliciously crafted text message may lead to UI spoofing.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT208221; https://support.apple.com/en-us/HT208696; https://support.apple.com/en-us/HT209192
CVE: CVE-2018-4391
Published: 2020-10-27
Description: An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan, watchOS 4.3, iOS 12.1. Processing a maliciously crafted text message may lead to UI spoofing.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT208221; https://support.apple.com/en-us/HT208696; https://support.apple.com/en-us/HT209192
CVE: CVE-2018-4428
Published: 2020-10-27
Description: A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 12.1.1. A local attacker may be able to share items from the lock screen.
CVSS Score: 7.1 (HIGH)
References: https://support.apple.com/en-us/HT209340; https://support.apple.com/en-us/HT209340
CVE: CVE-2018-4433
Published: 2020-10-27
Description: A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, watchOS 5, iOS 12, tvOS 12, macOS Mojave 10.14. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209106; https://support.apple.com/en-us/HT209107; https://support.apple.com/en-us/HT209108
CVE: CVE-2018-4444
Published: 2020-10-27
Description: A logic issue was addressed with improved state management. This issue is fixed in Safari 12.0.2, iOS 12.1.1, tvOS 12.1.1, iTunes 12.9.2 for Windows. Processing maliciously crafted web content may disclose sensitive user information.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209340; https://support.apple.com/en-us/HT209342; https://support.apple.com/en-us/HT209344
CVE: CVE-2018-4448
Published: 2020-10-27
Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.1.1, watchOS 5.1.2, macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra, tvOS 12.1.1. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209340; https://support.apple.com/en-us/HT209341; https://support.apple.com/en-us/HT209342
CVE: CVE-2018-4451
Published: 2020-10-27
Description: This issue is fixed in macOS Mojave 10.14. A memory corruption issue was addressed with improved input validation.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT209139; https://support.apple.com/en-us/HT209139
CVE: CVE-2018-4452
Published: 2020-10-27
Description: A memory consumption issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra, macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra. A malicious application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT209341; https://support.apple.com/en-us/HT209446; https://support.apple.com/en-us/HT209341
CVE: CVE-2018-4467
Published: 2020-10-27
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra, macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra. A malicious application may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT209341; https://support.apple.com/en-us/HT209446; https://support.apple.com/en-us/HT209341
CVE: CVE-2018-4468
Published: 2020-10-27
Description: This issue was addressed by removing additional entitlements. This issue is fixed in macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra. A malicious application may be able to access restricted files.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209193; https://support.apple.com/en-us/HT209193
CVE: CVE-2018-4474
Published: 2020-10-27
Description: A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.apple.com/en-us/HT209106; https://support.apple.com/en-us/HT209107; https://support.apple.com/en-us/HT209108
CVE: CVE-2019-6238
Published: 2020-10-27
Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. Processing a maliciously crafted package may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT209600
CVE: CVE-2019-7288
Published: 2020-10-27
Description: The issue was addressed with improved validation on the FaceTime server. This issue is fixed in macOS Mojave 10.14.3 Supplemental Update, iOS 12.1.4. A thorough security audit of the FaceTime service uncovered an issue with Live Photos .
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/HT209520; https://support.apple.com/en-us/HT209521; https://support.apple.com/en-us/HT209520
CVE: CVE-2019-7291
Published: 2020-10-27
Description: A denial of service issue was addressed with improved memory handling. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. An attacker in a privileged position may be able to perform a denial of service attack.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT210090; https://support.apple.com/en-us/HT210091; https://support.apple.com/en-us/HT210090
CVE: CVE-2019-8509
Published: 2020-10-27
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15. A malicious application may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT210634; https://support.apple.com/en-us/HT210722; https://support.apple.com/en-us/HT210634
CVE: CVE-2019-8525
Published: 2020-10-27
Description: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://support.apple.com/en-us/HT209599; https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT209602
CVE: CVE-2019-8528
Published: 2020-10-27
Description: A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://support.apple.com/en-us/HT209599; https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT209602
CVE: CVE-2019-8532
Published: 2020-10-27
Description: A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in watchOS 5.2, iOS 12.2. A malicious application may be able to access restricted files.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209599; https://support.apple.com/en-us/HT209602; https://support.apple.com/en-us/HT209599
CVE: CVE-2019-8534
Published: 2020-10-27
Description: A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT209600
CVE: CVE-2019-8538
Published: 2020-10-27
Description: A denial of service issue was addressed with improved validation. This issue is fixed in watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. Processing a maliciously crafted vcf file may lead to a denial of service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209599; https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT209602
CVE: CVE-2019-8539
Published: 2020-10-27
Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra. A malicious application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT210348; https://support.apple.com/en-us/HT210348
CVE: CVE-2019-8547
Published: 2020-10-27
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, watchOS 5.2, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, iOS 12.2. A remote attacker may be able to leak memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://support.apple.com/en-us/HT209599; https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT209602
CVE: CVE-2019-8564
Published: 2020-10-27
Description: A logic issue was addressed with improved validation. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. An attacker in a privileged network position can modify driver state.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT209600
CVE: CVE-2019-8569
Published: 2020-10-27
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. An application may be able to execute arbitrary code with system privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://support.apple.com/en-us/HT209600; https://support.apple.com/en-us/HT210119; https://support.apple.com/en-us/HT209600
CVE: CVE-2019-8570
Published: 2020-10-27
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 12.1.3, iCloud for Windows 7.10, iTunes 12.9.3 for Windows, Safari 12.0.3, tvOS 12.1.2. Processing maliciously crafted web content may disclose sensitive user information.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT209443; https://support.apple.com/en-us/HT209447; https://support.apple.com/en-us/HT209449
CVE: CVE-2019-8572
Published: 2020-10-27
Description: A null pointer dereference was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://support.apple.com/en-us/HT210090; https://support.apple.com/en-us/HT210091; https://support.apple.com/en-us/HT210090
CVE: CVE-2019-8573
Published: 2020-10-27
Description: An input validation issue was addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, iOS 12.3, watchOS 5.2.1. A remote attacker may be able to cause a system denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/en-us/HT210118; https://support.apple.com/en-us/HT210119; https://support.apple.com/en-us/HT210122
CVE: CVE-2019-8575
Published: 2020-10-27
Description: The issue was addressed with improved data deletion. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A base station factory reset may not delete all user information.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT210090; https://support.apple.com/en-us/HT210091; https://support.apple.com/en-us/HT210090
CVE: CVE-2019-8578
Published: 2020-10-27
Description: A use after free issue was addressed with improved memory management. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://support.apple.com/en-us/HT210090; https://support.apple.com/en-us/HT210091; https://support.apple.com/en-us/HT210090