deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-9245
Published: 2020-08-10
Description: HUAWEI P30 versions Versions earlier than 10.1.0.160(C00E160R2P11);HUAWEI P30 Pro versions Versions earlier than 10.1.0.160(C00E160R2P8) have a denial of service vulnerability. Certain system configuration can be modified because of improper authorization. The attacker could trick the user installing and executing a malicious application, successful exploit could cause a denial of service condition of PHONE function.
CVSS Score: 5.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-01-smartphone-en
CVE: CVE-2020-15139
Published: 2020-08-10
Description: In MyBB before version 1.8.24, the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. After upgrading MyBB to 1.8.24, make sure to update the version attribute in the `codebuttons` template for non-default themes to serve the latest version of the patched `jscripts/bbcodes_sceditor.js` file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/mybb/mybb/commit/37ad29dcd25489a37bdd89ebac761f22492558b0; https://github.com/mybb/mybb/security/advisories/GHSA-37h7-vfv6-f8rj; https://mybb.com/versions/1.8.24/
CVE: CVE-2020-16275
Published: 2020-08-10
Description: A cross-site scripting (XSS) vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://download.saintcorporation.com/products/saint_advisory15.txt; https://download.saintcorporation.com/products/saint_advisory15.txt
CVE: CVE-2020-16276
Published: 2020-08-10
Description: An SQL injection vulnerability in the Assets component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://download.saintcorporation.com/products/saint_advisory15.txt; https://download.saintcorporation.com/products/saint_advisory15.txt
CVE: CVE-2020-16277
Published: 2020-08-10
Description: An SQL injection vulnerability in the Analytics component of SAINT Security Suite 8.0 through 9.8.20 allows a remote, authenticated attacker to gain unauthorized access to the database.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://download.saintcorporation.com/products/saint_advisory15.txt; https://download.saintcorporation.com/products/saint_advisory15.txt
CVE: CVE-2020-16278
Published: 2020-08-10
Description: A cross-site scripting (XSS) vulnerability in the Permissions component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://download.saintcorporation.com/products/saint_advisory15.txt; https://download.saintcorporation.com/products/saint_advisory15.txt
CVE: CVE-2020-9079
Published: 2020-08-11
Description: FusionSphere OpenStack 8.0.0 have a protection mechanism failure vulnerability. The product incorrectly uses a protection mechanism. An attacker has to find a way to exploit the vulnerability to conduct directed attacks against the affected product.
CVSS Score: 8.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-01-failure-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-01-failure-en
CVE: CVE-2020-4485
Published: 2020-08-11
Description: IBM QRadar 7.2.0 through 7.2.9 could allow an authenticated user to disable the Wincollect service which could aid an attacker in bypassing security mechanisms in future attacks. IBM X-Force ID: 181860.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181860; https://www.ibm.com/support/pages/node/6257885; https://exchange.xforce.ibmcloud.com/vulnerabilities/181860
CVE: CVE-2020-4486
Published: 2020-08-11
Description: IBM QRadar 7.2.0 thorugh 7.2.9 could allow an authenticated user to overwrite or delete arbitrary files due to a flaw after WinCollect installation. IBM X-Force ID: 181861.
CVSS Score: 8.1 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181861; https://www.ibm.com/support/pages/node/6257885; https://exchange.xforce.ibmcloud.com/vulnerabilities/181861
CVE: CVE-2020-10777
Published: 2020-08-11
Description: A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://access.redhat.com/security/cve/cve-2020-10777; https://bugzilla.redhat.com/show_bug.cgi?id=1847605; https://access.redhat.com/security/cve/cve-2020-10777
CVE: CVE-2020-10778
Published: 2020-08-11
Description: In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-669
References: https://access.redhat.com/security/cve/cve-2020-10778; https://bugzilla.redhat.com/show_bug.cgi?id=1847628; https://access.redhat.com/security/cve/cve-2020-10778
CVE: CVE-2020-10779
Published: 2020-08-11
Description: Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://access.redhat.com/security/cve/cve-2020-10779; https://bugzilla.redhat.com/show_bug.cgi?id=1847647; https://access.redhat.com/security/cve/cve-2020-10779
CVE: CVE-2020-10783
Published: 2020-08-11
Description: Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.
CVSS Score: 8.3 (HIGH)
References: https://access.redhat.com/security/cve/cve-2020-10783; https://bugzilla.redhat.com/show_bug.cgi?id=1847811; https://access.redhat.com/security/cve/cve-2020-10783
CVE: CVE-2020-14325
Published: 2020-08-11
Description: Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.
CVSS Score: 9.1 (CRITICAL)
References: https://access.redhat.com/security/cve/cve-2020-14325; https://bugzilla.redhat.com/show_bug.cgi?id=1855739; https://access.redhat.com/security/cve/cve-2020-14325
CVE: CVE-2020-10780
Published: 2020-08-11
Description: Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1236
References: https://access.redhat.com/security/cve/cve-2020-10780; https://bugzilla.redhat.com/show_bug.cgi?id=1847794; https://access.redhat.com/security/cve/cve-2020-10780
CVE: CVE-2020-14296
Published: 2020-08-11
Description: Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.
CVSS Score: 7.1 (HIGH)
CWE: CWE-918
References: https://access.redhat.com/security/cve/cve-2020-14296; https://bugzilla.redhat.com/show_bug.cgi?id=1847860; https://access.redhat.com/security/cve/cve-2020-14296
CVE: CVE-2020-14313
Published: 2020-08-11
Description: An information disclosure vulnerability was found in Red Hat Quay in versions before 3.3.1. This flaw allows an attacker who can create a build trigger in a repository, to disclose the names of robot accounts and the existence of private repositories within any namespace.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.redhat.com/show_bug.cgi?id=1853026; https://bugzilla.redhat.com/show_bug.cgi?id=1853026
CVE: CVE-2020-14324
Published: 2020-08-11
Description: A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-78
References: https://access.redhat.com/security/cve/cve-2020-14324; https://bugzilla.redhat.com/show_bug.cgi?id=1855713; https://access.redhat.com/security/cve/cve-2020-14324
CVE: CVE-2020-11552
Published: 2020-08-11
Description: An elevation of privilege vulnerability exists in ManageEngine ADSelfService Plus before build 6003 because it does not properly enforce user privileges associated with a Certificate dialog. This vulnerability could allow an unauthenticated attacker to escalate privileges on a Windows host. An attacker does not require any privilege on the target system in order to exploit this vulnerability. One option is the self-service option on the Windows login screen. Upon selecting this option, the thick-client software is launched, which connects to a remote ADSelfService Plus server to facilitate self-service operations. An unauthenticated attacker having physical access to the host could trigger a security alert by supplying a self-signed SSL certificate to the client. The View Certificate option from the security alert allows an attacker to export a displayed certificate to a file. This can further cascade to a dialog that can open Explorer as SYSTEM. By navigating from Explorer to \windows\system32, cmd.exe can be launched as a SYSTEM.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: http://packetstormsecurity.com/files/158820/ManageEngine-ADSelfService-Plus-6000-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Aug/4; http://seclists.org/fulldisclosure/2020/Aug/6
CVE: CVE-2020-13124
Published: 2020-08-11
Description: SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://github.com/sabnzbd/sabnzbd/commits/develop; https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-9x87-96gg-33w2; https://sabnzbd.org/downloads
CVE: CVE-2020-15597
Published: 2020-08-11
Description: SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.sevenlayers.com/index.php/364-soplanning-v1-46-01-xss-session-hijack; https://www.soplanning.org; https://www.sevenlayers.com/index.php/364-soplanning-v1-46-01-xss-session-hijack
CVE: CVE-2020-16092
Published: 2020-08-11
Description: In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
CVSS Score: 3.8 (LOW)
CWE: CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00024.html; http://www.openwall.com/lists/oss-security/2020/08/10/1; https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html
CVE: CVE-2020-17367
Published: 2020-08-11
Description: Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option, which may lead to command injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-88
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00036.html; https://github.com/netblue30/firejail; https://lists.debian.org/debian-lts-announce/2020/08/msg00033.html
CVE: CVE-2020-17368
Published: 2020-08-11
Description: Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00036.html; https://github.com/netblue30/firejail/; https://lists.debian.org/debian-lts-announce/2020/08/msg00033.html
CVE: CVE-2020-17448
Published: 2020-08-11
Description: Telegram Desktop through 2.1.13 allows a spoofed file type to bypass the Dangerous File Type Execution protection mechanism, as demonstrated by use of the chat window with a filename that lacks an extension.
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram-CVE-2020-17448; https://github.com/telegramdesktop/tdesktop/releases/tag/v2.2.0; https://security.gentoo.org/glsa/202101-34
CVE: CVE-2020-17466
Published: 2020-08-11
Description: Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-670
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.turcom.com.tr/en/urunlerimiz-sorunsuz-internet-trcwifizone.asp; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2020-13174
Published: 2020-08-11
Description: The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://advisory.teradici.com/security-advisories/58/; https://advisory.teradici.com/security-advisories/58/
CVE: CVE-2020-13175
Published: 2020-08-11
Description: The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows an unauthenticated remote attacker to leak LDAP credentials via a specially crafted HTTP request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-98, CWE-829
References: https://advisory.teradici.com/security-advisories/59/; https://advisory.teradici.com/security-advisories/59/
CVE: CVE-2020-13176
Published: 2020-08-11
Description: The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://advisory.teradici.com/security-advisories/59/; https://advisory.teradici.com/security-advisories/59/
CVE: CVE-2020-13177
Published: 2020-08-11
Description: The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded paths for certain Windows binaries, which allows an attacker to gain elevated privileges via execution of a malicious binary placed in the system path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://advisory.teradici.com/security-advisories/60/; https://advisory.teradici.com/security-advisories/60/
CVE: CVE-2020-13178
Published: 2020-08-11
Description: A function in the Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to version 20.04.1 does not properly validate the signature of an external binary, which could allow an attacker to gain elevated privileges via execution in the context of the PCoIP Agent process.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-345, CWE-345
References: https://advisory.teradici.com/security-advisories/60/; https://advisory.teradici.com/security-advisories/60/
CVE: CVE-2020-14979
Published: 2020-08-11
Description: The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, to read and write to arbitrary memory locations. This allows any user to gain NT AUTHORITY\SYSTEM privileges by mapping \Device\PhysicalMemory into the calling process.
CVSS Score: 7.8 (HIGH)
References: https://posts.specterops.io/cve-2020-14979-local-privilege-escalation-in-evga-precisionx1-cf63c6b95896; https://www.evga.com/precisionx1/; https://posts.specterops.io/cve-2020-14979-local-privilege-escalation-in-evga-precisionx1-cf63c6b95896
CVE: CVE-2020-15071
Published: 2020-08-11
Description: content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/symphonycms/symphonycms/issues/2917; https://github.com/symphonycms/symphonycms/issues/2917
CVE: CVE-2020-11976
Published: 2020-08-11
Description: By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://lists.apache.org/thread.html/r[PII_REDACTED]0eb6b9d4d40d56b5621dd4ae9715e6f41f12ae2288ec49%40%3Cdev.directory.apache.org%3E; https://lists.apache.org/thread.html/r104eeefeb1e9da51f7ef79cef0f9ff12e21ef8559b77801e86b21e16%40%3Cusers.wicket.apache.org%3E; https://lists.apache.org/thread.html/r982c626dbce5c995223c4a6ddd7685de3592f8d65ba8372da1f3ce19%40%3Cdev.directory.apache.org%3E
CVE: CVE-2020-13179
Published: 2020-08-11
Description: Broker Protocol messages in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows prior to 20.04.1 are not cleaned up in server memory, which may allow an attacker to read confidential information from a memory dump via forcing a crashing during the single sign-on procedure.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-212
References: https://advisory.teradici.com/security-advisories/60/; https://advisory.teradici.com/security-advisories/60/
CVE: CVE-2020-8918
Published: 2020-08-11
Description: An improperly initialized 'migrationAuth' value in Google's go-tpm TPM1.2 library versions prior to 0.3.0 can lead an eavesdropping attacker to discover the auth value for a key created with CreateWrapKey. An attacker listening in on the channel can collect both 'encUsageAuth' and 'encMigrationAuth', and then can calculate 'usageAuth ^ encMigrationAuth' as the 'migrationAuth' can be guessed for all keys created with CreateWrapKey. TPM2.0 is not impacted by this. We recommend updating your library to 0.3.0 or later, or, if you cannot update, to call CreateWrapKey with a random 20-byte value for 'migrationAuth'.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-665, CWE-665
References: https://github.com/google/go-tpm/security/advisories/GHSA-5x29-3hr9-6wpw; https://github.com/google/go-tpm/security/advisories/GHSA-5x29-3hr9-6wpw
CVE: CVE-2020-9244
Published: 2020-08-11
Description: HUAWEI Mate 20 versions Versions earlier than 10.1.0.160(C00E160R3P8);HUAWEI Mate 20 Pro versions Versions earlier than 10.1.0.270(C431E7R1P5),Versions earlier than 10.1.0.270(C635E3R1P5),Versions earlier than 10.1.0.273(C636E7R2P4);HUAWEI Mate 20 X versions Versions earlier than 10.1.0.160(C00E160R2P8);HUAWEI P30 versions Versions earlier than 10.1.0.160(C00E160R2P11);HUAWEI P30 Pro versions Versions earlier than 10.1.0.160(C00E160R2P8);HUAWEI Mate 20 RS versions Versions earlier than 10.1.0.160(C786E160R3P8);HonorMagic2 versions Versions earlier than 10.0.0.187(C00E61R2P11);Honor20 versions Versions earlier than 10.0.0.175(C00E58R4P11);Honor20 PRO versions Versions earlier than 10.0.0.194(C00E62R8P12);HonorMagic2 versions Versions earlier than 10.0.0.187(C00E61R2P11);HonorV20 versions Versions earlier than 10.0.0.188(C00E62R2P11) have an improper authentication vulnerability. The system does not properly sign certain encrypted file, the attacker should gain the key used to encrypt the file, successful exploit could cause certain file be forged
CVSS Score: 6.8 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200805-02-smartphone-en
CVE: CVE-2020-9403
Published: 2020-08-11
Description: In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable format, and may be retrieved by any user with access to the PACTware workstation.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf; https://pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf
CVE: CVE-2020-9404
Published: 2020-08-11
Description: In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure manner, and may be modified by an attacker with no knowledge of the current passwords.
CVSS Score: 7.1 (HIGH)
CWE: CWE-522
References: https://pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf; https://pactware.com/fileadmin/user_upload/Cyber-Security-Documents/2020-05-29_published_PWC_CyberSecurityNotifications-CVE-2020-9403-9404__002_.pdf
CVE: CVE-2019-17339
Published: 2020-08-11
Description: The VirtualRouter component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that theoretically allows an attacker to inject scripts via URLs. The attacker could theoretically social engineer an authenticated user into submitting the URL, thus executing the script on the affected system with the privileges of the user. Affected releases are TIBCO Software Inc.'s TIBCO Silver Fabric: versions 6.0.0 and below.
CVSS Score: 6.8 (MEDIUM)
References: http://www.tibco.com/services/support/advisories; http://www.tibco.com/services/support/advisories
CVE: CVE-2020-0108
Published: 2020-08-11
Description: In postNotification of ServiceRecord.java, there is a possible bypass of foreground process restrictions due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.1 Android-9Android ID: A-140108616
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: https://source.android.com/security/bulletin/2020-08-01; https://source.android.com/security/bulletin/2020-08-01