deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-20755
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects D6220 before 1.0.0.46, D6400 before 1.0.0.80, D7000v2 before 1.0.0.51, D8500 before 1.0.3.42, DGN2200v1 before 1.0.0.58, DGN2200B before 1.0.0.58, JNDR3000 before 1.0.0.24, RBW30 before 2.1.4.16, R6250 before 1.0.4.26, R6300v2 before 1.0.4.28, R6400 before 1.0.1.42, R6400v2 before 1.0.2.56, R6700 before 1.0.1.46, R6900 before 1.0.1.46, R7000 before 1.0.9.32, R6900P before 1.3.1.44, R7100LG before 1.0.0.46, R7300DST before 1.0.0.68, R7000P before 1.3.1.44, R7900 before 1.0.2.16, R8000P before 1.4.0.10, R7900P before 1.4.0.10, R8300 before 1.0.2.122, R8500 before 1.0.2.122, R8000 before 1.0.4.18, WNDR3400v3 before 1.0.1.22, WNDR4500v2 before 1.0.0.72, WNR3500Lv2 before 1.2.0.54, WN3100RP before 1.0.0.20, and WN2500RPv2 before 1.0.1.54.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000060627/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Modem-Routers-Extenders-and-Orbi-Satellites-PSV-2018-0053; https://kb.netgear.com/000060627/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-Some-Routers-Modem-Routers-Extenders-and-Orbi-Satellites-PSV-2018-0053
CVE: CVE-2019-20756
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by reflected XSS. This affects EX7000 before 1.0.0.64, EX6200 before 1.0.3.86, EX6150 before 1.0.0.38, EX6130 before 1.0.0.22, EX6120 before 1.0.0.40, EX6100 before 1.0.2.22, EX6000 before 1.0.0.30, EX3700 before 1.0.0.70, EX3800 before 1.0.0.70, R8300 before 1.0.2.94, R7300DST before 1.0.0.62, R7000P before 1.3.0.20, R6900P before 1.3.0.20, R6400 before 1.0.1.32, R6300v2 before 1.0.4.24, R8500 before 1.0.2.94, WNDR3400v3 before 1.0.1.18, and WN2500RPv2 before 1.0.1.52.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000060643/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Routers-and-Extenders-PSV-2017-0709; https://kb.netgear.com/000060643/Security-Advisory-for-Reflected-Cross-Site-Scripting-on-Some-Routers-and-Extenders-PSV-2017-0709
CVE: CVE-2019-20757
Published: 2020-04-16
Description: NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-77
References: https://kb.netgear.com/000060642/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0358; https://kb.netgear.com/000060642/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0358
CVE: CVE-2019-20758
Published: 2020-04-16
Description: NETGEAR R7000 devices before 1.0.9.42 are affected by a buffer overflow by an authenticated user.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://kb.netgear.com/000060641/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-R7000-PSV-2018-0377; https://kb.netgear.com/000060641/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-R7000-PSV-2018-0377
CVE: CVE-2019-20759
Published: 2020-04-16
Description: NETGEAR R9000 devices before 1.0.4.26 are affected by stored XSS.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://kb.netgear.com/000060640/Security-Advisory-for-Stored-Cross-Site-Scripting-on-R9000-PSV-2018-0617; https://kb.netgear.com/000060640/Security-Advisory-for-Stored-Cross-Site-Scripting-on-R9000-PSV-2018-0617
CVE: CVE-2019-20760
Published: 2020-04-16
Description: NETGEAR R9000 devices before 1.0.4.26 are affected by authentication bypass.
CVSS Score: 8.8 (HIGH)
References: https://kb.netgear.com/000060639/Security-Advisory-for-Authentication-Bypass-on-R9000-PSV-2018-0615; https://kb.netgear.com/000060639/Security-Advisory-for-Authentication-Bypass-on-R9000-PSV-2018-0615
CVE: CVE-2019-20761
Published: 2020-04-16
Description: NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user.
CVSS Score: 8.0 (HIGH)
CWE: CWE-77
References: https://kb.netgear.com/000060638/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0383; https://kb.netgear.com/000060638/Security-Advisory-for-Post-Authentication-Command-Injection-on-R7800-PSV-2018-0383
CVE: CVE-2019-20762
Published: 2020-04-16
Description: Certain NETGEAR devices are affected by a buffer overflow by an authenticated user. This affects D8500 before 1.0.3.43, R8500 before 1.0.2.128, R8300 before 1.0.2.128, R8000 before 1.0.4.28, R7300DST before 1.0.0.68, R7100LG before 1.0.0.48, R6900P before 1.3.1.44, R7900P before 1.4.1.30, R8000P before 1.4.1.30, R7000P before 1.3.1.44, R7000 before 1.0.9.34, R6900 before 1.0.2.4, R6700 before 1.0.2.6, and R6400 before 1.0.1.44.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-120
References: https://kb.netgear.com/000060637/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Modem-Routers-and-Gateways-PSV-2018-0197; https://kb.netgear.com/000060637/Security-Advisory-for-Post-Authentication-Buffer-Overflow-on-Some-Routers-Modem-Routers-and-Gateways-PSV-2018-0197
CVE: CVE-2019-20763
Published: 2020-04-16
Description: NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000060636/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0145; https://kb.netgear.com/000060636/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0145
CVE: CVE-2019-20764
Published: 2020-04-16
Description: NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000060635/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0137; https://kb.netgear.com/000060635/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0137
CVE: CVE-2019-20765
Published: 2020-04-16
Description: NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000060634/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0136; https://kb.netgear.com/000060634/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0136
CVE: CVE-2019-20766
Published: 2020-04-16
Description: NETGEAR R7800 devices before 1.0.2.52 are affected by a stack-based buffer overflow by an authenticated user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://kb.netgear.com/000060633/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0135; https://kb.netgear.com/000060633/Security-Advisory-for-Post-Authentication-Stack-Overflow-on-R7800-PSV-2018-0135
CVE: CVE-2020-5266
Published: 2020-04-16
Description: In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/ps_linklist/commit/b90005c2cfed949ab564228b277a728e0a62a876; https://github.com/PrestaShop/ps_linklist/security/advisories/GHSA-vr7g-vqp5-966j; https://github.com/PrestaShop/ps_linklist/commit/b90005c2cfed949ab564228b277a728e0a62a876
CVE: CVE-2020-5273
Published: 2020-04-16
Description: In PrestaShop module ps_linklist versions before 3.1.0, there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/ps_linklist/commit/83e6e0bdda2287f4d6e64127cb90c41d26b5ad82; https://github.com/PrestaShop/ps_linklist/security/advisories/GHSA-cx2r-mf6x-55rx; https://github.com/PrestaShop/ps_linklist/commit/83e6e0bdda2287f4d6e64127cb90c41d26b5ad82
CVE: CVE-2020-5294
Published: 2020-04-16
Description: PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/PrestaShop/ps_socialfollow/commit/c1768bf14c0fcf8311bea15fba4ffdda45522d6b; https://github.com/PrestaShop/ps_socialfollow/security/advisories/GHSA-774w-fg8p-7c8w; https://github.com/PrestaShop/ps_socialfollow/commit/c1768bf14c0fcf8311bea15fba4ffdda45522d6b
CVE: CVE-2019-7306
Published: 2020-04-17
Description: Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-552
References: https://bugs.launchpad.net/ubuntu/+source/byobu/+bug/1827202; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7306; https://bugs.launchpad.net/ubuntu/+source/byobu/+bug/1827202
CVE: CVE-2020-11868
Published: 2020-04-17
Description: ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346, CWE-346
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html; http://support.ntp.org/bin/view/Main/NtpBug3592
CVE: CVE-2020-11872
Published: 2020-04-17
Description: The Cloud Functions subsystem in OpenTrace 1.0 might allow fabrication attacks by making billions of TempID requests before an AES-256-GCM key rotation occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://github.com/opentrace-community/opentrace-cloud-functions/issues/7; https://github.com/opentrace-community/opentrace-cloud-functions/issues/7
CVE: CVE-2020-10211
Published: 2020-04-17
Description: A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive information.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0004; https://www.mitel.com/support/security-advisories
CVE: CVE-2020-10377
Published: 2020-04-17
Description: A weak encryption vulnerability in Mitel MiVoice Connect Client before[PII_REDACTED].0 could allow an unauthenticated attacker to gain access to user credentials. A successful exploit could allow an attacker to access the system with compromised user credentials.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://www.mitel.com/support/security-advisories; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0004; https://www.mitel.com/support/security-advisories
CVE: CVE-2020-10813
Published: 2020-04-17
Description: A buffer overflow vulnerability in FTPDMIN 0.96 allows attackers to crash the server via a crafted packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.povonsec.com/ftpdmin-denial-of-service-exploit/; https://www.sentex.ca/~mwandel/ftpdmin/; https://www.povonsec.com/ftpdmin-denial-of-service-exploit/
CVE: CVE-2020-10947
Published: 2020-04-17
Description: Mac Endpoint for Sophos Central before 9.9.6 and Mac Endpoint for Sophos Home before 2.2.6 allow Privilege Escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: https://community.sophos.com/b/security-blog/posts/advisory-cve-2020-10947---sophos-anti-virus-for-macos-privilege-escalation; https://www.sophos.com/en-us.aspx; https://community.sophos.com/b/security-blog/posts/advisory-cve-2020-10947---sophos-anti-virus-for-macos-privilege-escalation
CVE: CVE-2020-11793
Published: 2020-04-17
Description: A use-after-free issue exists in WebKitGTK before 2.28.1 and WPE WebKit before 2.28.1 via crafted web content that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash).
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00008.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3P4YISPE5QX4YD54GDRZIH2X5RCH3QGW/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3MQTRC6ITFTVS5R5Z24PMJS6FXJKGRD/
CVE: CVE-2019-12001
Published: 2020-04-17
Description: A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage version(s): GL225P001 and earlier; GL225P001 and earlier; VE270R001-01 and earlier; GL225P001 and earlier; VL270R001-01 and earlier; VL270R001-01 and earlier.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-613
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03940en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03940en_us
CVE: CVE-2019-12002
Published: 2020-04-17
Description: A remote session reuse vulnerability leading to access restriction bypass was discovered in HPE MSA 2040 SAN Storage; HPE MSA 1040 SAN Storage; HPE MSA 1050 SAN Storage; HPE MSA 2042 SAN Storage; HPE MSA 2050 SAN Storage; HPE MSA 2052 SAN Storage version(s): GL225P001 and earlier; GL225P001 and earlier; VE270R001-01 and earlier; GL225P001 and earlier; VL270R001-01 and earlier; VL270R001-01 and earlier.
CVSS Score: 9.8 (CRITICAL)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03940en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03940en_us
CVE: CVE-2019-20769
Published: 2020-04-17
Description: An issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier). DLL Hijacking can occur via a Trojan horse DLL in the current working directory. The LG ID is LVE-MOT-190001 (November 2019).
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20770
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 9.0 software. The HAL service has a buffer overflow that leads to arbitrary code execution. The LG ID is LVE-SMP-190013 (September 2019).
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20771
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. WapService allows unconfirmed configuration changes via a modified OMACP message. The LG ID is LVE-SMP-190006 (August 2019).
CVSS Score: 7.5 (HIGH)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20772
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Account subsystem allows authorization bypass. The LG ID is LVE-SMP-190007 (August 2019).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20773
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. Unprivileged applications can execute shell commands via the connectivity service. The LG ID is LVE-SMP-190008 (August 2019).
CVSS Score: 7.8 (HIGH)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20774
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. A system service allows local retrieval of the user's password. The LG ID is LVE-SMP-190009 (August 2019).
CVSS Score: 5.5 (MEDIUM)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20775
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software. Weak encryption leads to local information disclosure. The LG ID is LVE-SMP-190010 (August 2019).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-327
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20776
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. A TZ trusted application can crash via crafted input. The LG ID is LVE-SMP-190005 (July 2019).
CVSS Score: 5.5 (MEDIUM)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20777
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. WapService mishandles OTA Provisioning on V40 and G7 devices. The LG ID is LVE-SMP-190006 (July 2019).
CVSS Score: 9.8 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20778
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. The Backup subsystem does not properly restrict operations or validate their input. The LG ID is LVE-SMP-190004 (June 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20779
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, 8.1, and 9.0 software. A TrustZone trusted application can crash via crafted input. The LG ID is LVE-SMP-190003 (May 2019).
CVSS Score: 5.5 (MEDIUM)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20780
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Certain security settings, related to whether packages are verified and accepted only from known sources, are mishandled. The LG ID is LVE-SMP-190002 (April 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-427
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20782
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. LG Advanced Flash (LAF) has a buffer overflow. The LG ID is LVE-SMP-190001 (March 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20783
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (North America CDMA) software. The LTE protocol implementation allows a bypass of AKA (Authentication and Key Agreement). The LG ID is LVE-SMP-180014 (February 2019).
CVSS Score: 9.1 (CRITICAL)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20784
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 (MTK chipsets) software. Interaction of GPS with 911 emergency calls is mishandled. The LG ID is LVE-SMP-180012 (January 2019).
CVSS Score: 5.5 (MEDIUM)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-20785
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable. The LG ID is LVE-SMP-180013 (January 2019).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-908
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2019-4446
Published: 2020-04-17
Description: IBM Maximo Asset Management 7.6 could allow an authenticated user perform actions they are not authorized to by modifying request parameters. IBM X-Force ID: 163490.
CVSS Score: 5.4 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/163490; https://www.ibm.com/support/pages/node/6190215; https://exchange.xforce.ibmcloud.com/vulnerabilities/163490
CVE: CVE-2019-4644
Published: 2020-04-17
Description: IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 170880.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/170880; https://www.ibm.com/support/pages/node/6191583; https://exchange.xforce.ibmcloud.com/vulnerabilities/170880
CVE: CVE-2019-4749
Published: 2020-04-17
Description: IBM Maximo Asset Management 7.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 173308.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/173308; https://www.ibm.com/support/pages/node/6193479; https://exchange.xforce.ibmcloud.com/vulnerabilities/173308
CVE: CVE-2020-11873
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A stack-based buffer overflow in the logging tool could allow an attacker to gain privileges. The LG ID is LVE-SMP-200005 (April 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-11874
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9, and 10 software. Attackers can bypass Factory Reset Protection (FRP). The LG ID is LVE-SMP-200004 (March 2020).
CVSS Score: 7.5 (HIGH)
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-11875
Published: 2020-04-17
Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10.0 (MTK chipsets) software. The MTK kernel does not properly implement exception handling, allowing an attacker to gain privileges. The LG ID is LVE-SMP-200001 (February 2020).
CVSS Score: 7.8 (HIGH)
CWE: CWE-755
References: https://cwe.mitre.org/data/definitions/755.html; https://lgsecurity.lge.com/; https://cwe.mitre.org/data/definitions/755.html
CVE: CVE-2020-4277
Published: 2020-04-17
Description: IBM TRIRIGA Application Platform 3.5.3 and 3.6.1 discloses sensitive information in error messages that could aid an attacker formulate future attacks. IBM X-Force ID: 175993.
CVSS Score: 7.5 (HIGH)
CWE: CWE-209
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175993; https://www.ibm.com/support/pages/node/6193467; https://exchange.xforce.ibmcloud.com/vulnerabilities/175993
CVE: CVE-2020-9523
Published: 2020-04-17
Description: Insufficiently protected credentials vulnerability on Micro Focus enterprise developer and enterprise server, affecting all version prior to 4.0 Patch Update 16, and version 5.0 Patch Update 6. The vulnerability could allow an attacker to transmit hashed credentials for the user account running the Micro Focus Directory Server (MFDS) to an arbitrary site, compromising that account's security.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: https://softwaresupport.softwaregrp.com/doc/KM03634936; https://softwaresupport.softwaregrp.com/doc/KM03634936
CVE: CVE-2020-11876
Published: 2020-04-17
Description: airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of[PII_REDACTED]234fsdfsdr3242 for initialization of an OpenSSL EVP AES-256 CBC context. NOTE: the vendor states that this initialization only occurs within unreachable code
CVSS Score: 7.5 (HIGH)
CWE: CWE-327, CWE-327
References: https://dev.io/posts/zoomzoo/; https://dev.io/posts/zoomzoo/