deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-17447
Published: 2020-08-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-15139. Reason: This candidate is a duplicate of CVE-2020-15139. Notes: All CVE users should reference CVE-2020-15139 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-17451
Published: 2020-08-09
Description: flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://lists.openwall.net/full-disclosure/2020/08/07/1; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-flatcore-cms/; https://lists.openwall.net/full-disclosure/2020/08/07/1
CVE: CVE-2020-17452
Published: 2020-08-09
Description: flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://lists.openwall.net/full-disclosure/2020/08/07/1; https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-flatcore-cms/; https://lists.openwall.net/full-disclosure/2020/08/07/1
CVE: CVE-2020-12777
Published: 2020-08-10
Description: A function in Combodo iTop contains a vulnerability of Broken Access Control, which allows unauthorized attacker to inject command and disclose system information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/Combodo/iTop/security/advisories/GHSA-88fq-r22m-64q2; https://www.twcert.org.tw/tw/cp-132-3833-46ae7-1.html; https://github.com/Combodo/iTop/security/advisories/GHSA-88fq-r22m-64q2
CVE: CVE-2020-12778
Published: 2020-08-10
Description: Combodo iTop does not validate inputted parameters, attackers can inject malicious commands and launch XSS attack.
CVSS Score: 7.4 (HIGH)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-8vpf-8vjh-5fcv; https://www.twcert.org.tw/tw/cp-132-3834-591e2-1.html; https://github.com/Combodo/iTop/security/advisories/GHSA-8vpf-8vjh-5fcv
CVE: CVE-2020-12779
Published: 2020-08-10
Description: Combodo iTop contains a stored Cross-site Scripting vulnerability, which can be attacked by uploading file with malicious script.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/Combodo/iTop/security/advisories/GHSA-qqrf-j8qv-g247; https://www.twcert.org.tw/tw/cp-132-3835-e8e8f-1.html; https://github.com/Combodo/iTop/security/advisories/GHSA-qqrf-j8qv-g247
CVE: CVE-2020-12780
Published: 2020-08-10
Description: A security misconfiguration exists in Combodo iTop, which can expose sensitive information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://github.com/Combodo/iTop/security/advisories/GHSA-97cw-cjxc-9x78; https://www.twcert.org.tw/tw/cp-132-3836-47d6c-1.html; https://github.com/Combodo/iTop/security/advisories/GHSA-97cw-cjxc-9x78
CVE: CVE-2020-12781
Published: 2020-08-10
Description: Combodo iTop contains a cross-site request forgery (CSRF) vulnerability, attackers can execute specific commands via malicious site request forgery.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/Combodo/iTop/security/advisories/GHSA-34rq-vfmf-gg5v; https://www.twcert.org.tw/tw/cp-132-3837-050db-1.html; https://github.com/Combodo/iTop/security/advisories/GHSA-34rq-vfmf-gg5v
CVE: CVE-2020-4533
Published: 2020-08-10
Description: IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182717.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182717; https://www.ibm.com/support/pages/node/6257565; https://exchange.xforce.ibmcloud.com/vulnerabilities/182717
CVE: CVE-2020-4539
Published: 2020-08-10
Description: IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182914; https://www.ibm.com/support/pages/node/6257575; https://exchange.xforce.ibmcloud.com/vulnerabilities/182914
CVE: CVE-2020-4541
Published: 2020-08-10
Description: IBM Jazz Reporting Service 7.0 and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183039.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183039; https://www.ibm.com/support/pages/node/6257577; https://exchange.xforce.ibmcloud.com/vulnerabilities/183039
CVE: CVE-2020-13292
Published: 2020-08-10
Description: In GitLab before 13.0.12, 13.1.6 and 13.2.3, it is possible to bypass E-mail verification which is required for OAuth Flow.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-287
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13292.json; https://gitlab.com/gitlab-org/gitlab/-/issues/228629; https://hackerone.com/reports/922456
CVE: CVE-2020-13293
Published: 2020-08-10
Description: In GitLab before 13.0.12, 13.1.6 and 13.2.3 using a branch with a hexadecimal name could override an existing hash.
CVSS Score: 6.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13293.json; https://gitlab.com/gitlab-org/gitlab/-/issues/202690; https://hackerone.com/reports/790634
CVE: CVE-2020-13294
Published: 2020-08-10
Description: In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application.
CVSS Score: 4.2 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13294.json; https://gitlab.com/gitlab-org/gitlab/-/issues/26147; https://hackerone.com/reports/469728
CVE: CVE-2020-13295
Published: 2020-08-10
Description: For GitLab Runner before 13.0.12, 13.1.6, 13.2.3, by replacing dockerd with a malicious server, the Shared Runner is susceptible to SSRF.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13295.json; https://gitlab.com/gitlab-org/gitlab/-/issues/209096; https://hackerone.com/reports/809248
CVE: CVE-2020-6070
Published: 2020-08-10
Description: An exploitable code execution vulnerability exists in the file system checking functionality of fsck.f2fs 1.12.0. A specially crafted f2fs file can cause a logic flaw and out-of-bounds heap operations, resulting in code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-131
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SZ4HMQKNI35NBWJI6XMJBGWPEKZRR72/; https://talosintelligence.com/vulnerability_reports/TALOS-2020-0988; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SZ4HMQKNI35NBWJI6XMJBGWPEKZRR72/
CVE: CVE-2020-6145
Published: 2020-08-10
Description: An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. A specially crafted HTTP request can cause an SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1091; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1091
CVE: CVE-2020-8224
Published: 2020-08-10
Description: A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94, CWE-94
References: https://hackerone.com/reports/622170; https://nextcloud.com/security/advisory/?id=NC-SA-2020-030; https://security.gentoo.org/glsa/202009-09
CVE: CVE-2020-8229
Published: 2020-08-10
Description: A memory leak in the OCUtil.dll library used by Nextcloud Desktop Client 2.6.4 can lead to a DoS against the host system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400, CWE-401
References: https://hackerone.com/reports/588562; https://nextcloud.com/security/advisory/?id=NC-SA-2020-034; https://hackerone.com/reports/588562
CVE: CVE-2020-9525
Published: 2020-08-10
Description: CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attackers to perform a man-in-the-middle attack, as demonstrated by eavesdropping on user video/audio streams, capturing credentials, and compromising devices.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-522
References: https://hacked.camera; https://redprocyon.com; https://hacked.camera
CVE: CVE-2020-9526
Published: 2020-08-10
Description: CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an information exposure flaw that exposes user session data to supernodes in the network, as demonstrated by passively eavesdropping on user video/audio streams, capturing credentials, and compromising devices.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319, CWE-327
References: https://hacked.camera/; https://redprocyon.com; https://hacked.camera/
CVE: CVE-2020-9527
Published: 2020-08-10
Description: Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20, after 2018-08-09 through 2020), as used by many different vendors in millions of Internet of Things devices, suffers from buffer overflow vulnerability that allows unauthenticated remote attackers to execute arbitrary code via the peer-to-peer (P2P) service. This affects products marketed under the following brand names: Accfly, Alptop, Anlink, Besdersec, BOAVISION, COOAU, CPVAN, Ctronics, D3D Security, Dericam, Elex System, Elite Security, ENSTER, ePGes, Escam, FLOUREON, GENBOLT, Hongjingtian (HJT), ICAMI, Iegeek, Jecurity, Jennov, KKMoon, LEFTEK, Loosafe, Luowice, Nesuniq, Nettoly, ProElite, QZT, Royallite, SDETER, SV3C, SY2L, Tenvis, ThinkValue, TOMLOV, TPTEK, WGCC, and ZILINK.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://hacked.camera/; https://redprocyon.com; https://hacked.camera/
CVE: CVE-2020-9528
Published: 2020-08-10
Description: Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Things devices, suffers from cryptographic issues that allow remote attackers to access user session data, as demonstrated by eavesdropping on user video/audio streams, capturing credentials, and compromising devices. This affects products marketed under the following brand names: Accfly, Alptop, Anlink, Besdersec, BOAVISION, COOAU, CPVAN, Ctronics, D3D Security, Dericam, Elex System, Elite Security, ENSTER, ePGes, Escam, FLOUREON, GENBOLT, Hongjingtian (HJT), ICAMI, Iegeek, Jecurity, Jennov, KKMoon, LEFTEK, Loosafe, Luowice, Nesuniq, Nettoly, ProElite, QZT, Royallite, SDETER, SV3C, SY2L, Tenvis, ThinkValue, TOMLOV, TPTEK, WGCC, and ZILINK.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://hacked.camera/; https://redprocyon.com; https://hacked.camera/
CVE: CVE-2020-9529
Published: 2020-08-10
Description: Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20), as used by many different vendors in millions of Internet of Things devices, suffers from a privilege escalation vulnerability that allows attackers on the local network to reset the device's administrator password. This affects products marketed under the following brand names: Accfly, Alptop, Anlink, Besdersec, BOAVISION, COOAU, CPVAN, Ctronics, D3D Security, Dericam, Elex System, Elite Security, ENSTER, ePGes, Escam, FLOUREON, GENBOLT, Hongjingtian (HJT), ICAMI, Iegeek, Jecurity, Jennov, KKMoon, LEFTEK, Loosafe, Luowice, Nesuniq, Nettoly, ProElite, QZT, Royallite, SDETER, SV3C, SY2L, Tenvis, ThinkValue, TOMLOV, TPTEK, WGCC, and ZILINK.
CVSS Score: 9.8 (CRITICAL)
References: https://hacked.camera/; https://redprocyon.com; https://hacked.camera/
CVE: CVE-2020-17476
Published: 2020-08-10
Description: Mibew Messenger before 3.2.7 allows XSS via a crafted user name.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Mibew/mibew/commit/84f5bca0a90b2fe470e35e9b5121548ccce0093c; https://mibew.org/announcements/2020/07/09/mibew-messenger-3-2-7-has-been-released; https://github.com/Mibew/mibew/commit/84f5bca0a90b2fe470e35e9b5121548ccce0093c
CVE: CVE-2020-15647
Published: 2020-08-10
Description: A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins. This vulnerability affects Firefox for < Android.
CVSS Score: 7.4 (HIGH)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1647078; https://www.mozilla.org/security/advisories/mfsa2020-27/; https://bugzilla.mozilla.org/show_bug.cgi?id=1647078
CVE: CVE-2020-15648
Published: 2020-08-10
Description: Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird < 78 and Firefox < 78.0.2.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1021
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1644076; https://www.mozilla.org/security/advisories/mfsa2020-28/; https://www.mozilla.org/security/advisories/mfsa2020-29/
CVE: CVE-2020-15649
Published: 2020-08-10
Description: Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364; https://www.mozilla.org/security/advisories/mfsa2020-31/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364
CVE: CVE-2020-15650
Published: 2020-08-10
Description: Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
CVSS Score: 5.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1652360; https://www.mozilla.org/security/advisories/mfsa2020-31/; https://bugzilla.mozilla.org/show_bug.cgi?id=1652360
CVE: CVE-2020-15651
Published: 2020-08-10
Description: A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 28.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1649160; https://www.mozilla.org/security/advisories/mfsa2020-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1649160
CVE: CVE-2020-15652
Published: 2020-08-10
Description: By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.html
CVE: CVE-2020-15653
Published: 2020-08-10
Description: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1521542; https://usn.ubuntu.com/4443-1/
CVE: CVE-2020-15654
Published: 2020-08-10
Description: When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1648333; https://usn.ubuntu.com/4443-1/
CVE: CVE-2020-15655
Published: 2020-08-10
Description: A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1645204; https://usn.ubuntu.com/4443-1/
CVE: CVE-2020-15656
Published: 2020-08-10
Description: JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1647293; https://usn.ubuntu.com/4443-1/
CVE: CVE-2020-15657
Published: 2020-08-10
Description: Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1644954; https://www.mozilla.org/security/advisories/mfsa2020-30/
CVE: CVE-2020-15658
Published: 2020-08-10
Description: The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1637745; https://usn.ubuntu.com/4443-1/
CVE: CVE-2020-15659
Published: 2020-08-10
Description: Mozilla developers and community members reported memory safety bugs present in Firefox 78 and Firefox ESR 78.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.html
CVE: CVE-2020-15661
Published: 2020-08-10
Description: A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1654131; https://www.mozilla.org/security/advisories/mfsa2020-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1654131
CVE: CVE-2020-15662
Published: 2020-08-10
Description: A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1653827; https://www.mozilla.org/security/advisories/mfsa2020-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1653827
CVE: CVE-2020-17478
Published: 2020-08-10
Description: ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://github.com/FGasper/p5-Crypt-Perl/compare/0.32...0.33; https://github.com/FGasper/p5-Crypt-Perl/compare/0.32...0.33
CVE: CVE-2020-17479
Published: 2020-08-10
Description: jpv (aka Json Pattern Validator) before 2.2.2 does not properly validate input, as demonstrated by a corrupted array.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://blog.sonatype.com/cve-2020-17479; https://github.com/manvel-khnkoyan/jpv/commit/e3eec1215caa8d5c560f5e88d[PII_REDACTED]927d6; https://github.com/manvel-khnkoyan/jpv/issues/10
CVE: CVE-2020-17480
Published: 2020-08-10
Description: TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser, the paste plugin, and the visualchars plugin by using the clipboard or APIs to insert content into the editor.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95; https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes; https://github.com/tinymce/tinymce/security/advisories/GHSA-27gm-ghr9-4v95
CVE: CVE-2020-9078
Published: 2020-08-10
Description: FusionCompute 8.0.0 have local privilege escalation vulnerability. A local, authenticated attacker could perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege and compromise the service.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-01-fusioncompute-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-01-fusioncompute-en
CVE: CVE-2020-9243
Published: 2020-08-10
Description: HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a denial of service vulnerability. The system does not properly limit the depth of recursion, an attacker should trick the user installing and execute a malicious application. Successful exploit could cause a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-03-smartphone-en