deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-17774
Published: 2020-09-09
Description: Ingenico Telium 2 POS terminals have an insecure NTPT3 protocol. This is fixed in Telium 2 SDK v9.32.03 patch N.
CVSS Score: 6.8 (MEDIUM)
References: https://ingenico.us/smart-terminals/telium2; https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2020-12/; https://youtu.be/gtbS3Gr264w
CVE: CVE-2020-10049
Published: 2020-09-09
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The start-stop scripts for the services of the affected application could allow a local attacker to include arbitrary commands that are executed when services are started or stopped interactively by system administrators.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276, CWE-276
References: https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf
CVE: CVE-2020-10050
Published: 2020-09-09
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf
CVE: CVE-2020-10051
Published: 2020-09-09
Description: A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead of the legitimate service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-428
References: https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-251935.pdf
CVE: CVE-2020-10056
Published: 2020-09-09
Description: A vulnerability has been identified in License Management Utility (LMU) (All versions < V2.4). The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated attacker to execute arbitrary commands on the server with local SYSTEM privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250, CWE-269
References: https://cert-portal.siemens.com/productcert/pdf/ssa-709003.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-252-03; https://cert-portal.siemens.com/productcert/pdf/ssa-709003.pdf
CVE: CVE-2020-15784
Published: 2020-09-09
Description: A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). Insecure storage of sensitive information in the configuration files could allow the retrieval of user names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-312, CWE-312
References: https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf
CVE: CVE-2020-15785
Published: 2020-09-09
Description: A vulnerability has been identified in Siveillance Video Client (All versions). In environments where Windows NTLM authentication is enabled the affected client application transmits usernames to the server in cleartext. This could allow an attacker in a privileged network position to obtain valid adminstrator login names and use this information to launch further attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf; https://us-cert.cisa.gov/ics/advisories/icsa-20-252-05; https://cert-portal.siemens.com/productcert/pdf/ssa-770698.pdf
CVE: CVE-2020-15786
Published: 2020-09-09
Description: A vulnerability has been identified in SIMATIC HMI Basic Panels 2nd Generation (incl. SIPLUS variants) (All versions < V16), SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions <= V16), SIMATIC HMI Mobile Panels (All versions <= V16), SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently block excessive authentication attempts. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf
CVE: CVE-2020-15787
Published: 2020-09-09
Description: A vulnerability has been identified in SIMATIC HMI Unified Comfort Panels (All versions <= V16). Affected devices insufficiently validate authentication attempts as the information given can be truncated to match only a set number of characters versus the whole provided string. This could allow a remote attacker to discover user passwords and obtain access to the Sm@rt Server via a brute-force attack.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305, CWE-287
References: https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-542525.pdf
CVE: CVE-2020-15788
Published: 2020-09-09
Description: A vulnerability has been identified in Polarion Subversion Webclient (All versions). The Polarion subversion web application does not filter user input in a way that prevents Cross-Site Scripting. If a user is enticed into passing specially crafted, malicious input to the web client (e.g. by clicking on a malicious URL with embedded JavaScript), then JavaScript code can be returned and may then be executed by the user’s client. Various actions could be triggered by running malicious JavaScript code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf
CVE: CVE-2020-15789
Published: 2020-09-09
Description: A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who must be authenticated to the web interface. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allow the attacker to read or modify contents of the web application.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352, CWE-352
References: https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf
CVE: CVE-2020-15790
Published: 2020-09-09
Description: A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP8). If configured in an insecure manner, the web server might be susceptible to a directory listing attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-548, CWE-200
References: https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-568969.pdf
CVE: CVE-2020-15791
Published: 2020-09-09
Description: A vulnerability has been identified in SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 CPU family (incl. SIPLUS variants) (All versions), SIMATIC WinAC RTX (F) 2010 (All versions), SINUMERIK 840D sl (All versions). The authentication protocol between a client and a PLC via port 102/tcp (ISO-TSAP) insufficiently protects the transmitted password. This could allow an attacker that is able to intercept the network traffic to obtain valid PLC credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-381684.pdf
CVE: CVE-2020-1912
Published: 2020-09-09
Description: An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit[PII_REDACTED]69c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-787, CWE-125, CWE-787
References: https://github.com/facebook/hermes/commit/[PII_REDACTED]69c8fd5917d9b87acffa721ad2a168; https://www.facebook.com/security/advisories/cve-2020-1912; https://github.com/facebook/hermes/commit/[PII_REDACTED]69c8fd5917d9b87acffa721ad2a168
CVE: CVE-2020-1913
Published: 2020-09-09
Description: An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-195, CWE-681
References: https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6; https://www.facebook.com/security/advisories/cve-2020-1913; https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6
CVE: CVE-2020-24379
Published: 2020-09-09
Description: WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://github.com/erlyaws/yaws/commits/master; https://github.com/vulnbe/poc-yaws-dav-xxe; https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
CVE: CVE-2020-24916
Published: 2020-09-09
Description: CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/erlyaws/yaws/commits/master; https://github.com/vulnbe/poc-yaws-cgi-shell-injection; https://lists.debian.org/debian-lts-announce/2020/09/msg00022.html
CVE: CVE-2020-15903
Published: 2020-09-09
Description: An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3.
CVSS Score: 9.8 (CRITICAL)
References: https://www.nagios.com/downloads/nagios-xi/change-log/; https://www.nagios.com/downloads/nagios-xi/change-log/
CVE: CVE-2020-25219
Published: 2020-09-09
Description: url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00030.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00033.html; https://github.com/libproxy/libproxy/issues/134
CVE: CVE-2020-15173
Published: 2020-09-09
Description: In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), there is a buffer overflow when receiving an l2tp control packet ith an AVP which type is a string and no hidden flags, length set to less than 6. If your application is used in open networks or there are untrusted nodes in the network it is highly recommended to apply the patch. The problem was patched with commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b As a workaround changes of commit 2324bcd5ba12cf28f47357a8f03cd41b7c04c52b can be applied to older versions.
CVSS Score: 8.2 (HIGH)
CWE: CWE-119, CWE-120
References: https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b; https://github.com/accel-ppp/accel-ppp/security/advisories/GHSA-rr68-fchr-69vf; https://github.com/accel-ppp/accel-ppp/commit/2324bcd5ba12cf28f47357a8f03cd41b7c04c52b
CVE: CVE-2020-24655
Published: 2020-09-10
Description: A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices (effectively bypassing the PIN requirement).
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-362
References: https://www.twilio.com/changelog; https://www.twilio.com/changelog
CVE: CVE-2020-25220
Published: 2020-09-10
Description: The Linux kernel 4.9.x before 4.9.233, 4.14.x before 4.14.194, and 4.19.x before 4.19.140 has a use-after-free because skcd->no_refcnt was not considered during a backport of a CVE-2020-14356 patch. This is related to the cgroups feature.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1868453; https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.194; https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.140
CVE: CVE-2020-24552
Published: 2020-09-10
Description: Atop Technology industrial 3G/4G gateway contains Command Injection vulnerability. Due to insufficient input validation, the device's web management interface allows attackers to inject specific code and execute system commands without privilege.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.twcert.org.tw/tw/cp-132-3956-608f1-1.html; https://www.twcert.org.tw/tw/cp-132-3956-608f1-1.html
CVE: CVE-2020-7311
Published: 2020-09-10
Description: Privilege Escalation vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to assume SYSTEM rights during the installation of MA via manipulation of log files.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-269
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10325; https://kc.mcafee.com/corporate/index?page=content&id=SB10325
CVE: CVE-2020-7312
Published: 2020-09-10
Description: DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10325; https://kc.mcafee.com/corporate/index?page=content&id=SB10325
CVE: CVE-2020-7314
Published: 2020-09-10
Description: Privilege Escalation Vulnerability in the installer in McAfee Data Exchange Layer (DXL) Client for Mac shipped with McAfee Agent (MA) for Mac prior to MA 5.6.6 allows local users to run commands as root via incorrectly applied permissions on temporary files.
CVSS Score: 8.2 (HIGH)
CWE: CWE-732, CWE-732
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10325; https://kc.mcafee.com/corporate/index?page=content&id=SB10325
CVE: CVE-2020-7315
Published: 2020-09-10
Description: DLL Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code via careful placement of a malicious DLL.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-426, CWE-426
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10325; https://kc.mcafee.com/corporate/index?page=content&id=SB10325
CVE: CVE-2019-1535
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1536
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1537
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1538
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1539
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1540
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1541
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1542
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1544
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1545
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1546
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1548
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1550
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1553
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1554
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1555
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1556
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1557
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1558
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1560
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1561
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1562
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2019-1564
Published: 2020-09-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during [2019]. Notes: none
CVE: CVE-2020-24739
Published: 2020-09-10
Description: A CSRF vulnerability was found in iCMS v7.0.0 in the background deletion administrator account. When missing the CSRF_TOKEN and can still request normally, all administrators except the initial administrator will be deleted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/idreamsoft/iCMS/issues/76; https://github.com/idreamsoft/iCMS/issues/76
CVE: CVE-2020-25221
Published: 2020-09-10
Description: get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of the struct page that backs the vsyscall page. The result is a refcount underflow. This can be triggered by any 64-bit process that can use ptrace() or process_vm_readv(), aka CID-9fa2dd946743.
CVSS Score: 7.8 (HIGH)
CWE: CWE-672
References: http://www.openwall.com/lists/oss-security/2020/09/10/4; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.7; https://git.kernel.org/linus/8891adc61dce2a8a41fc0c23262b681c3ec4b73a
CVE: CVE-2020-5780
Published: 2020-09-10
Description: Missing Authentication for Critical Function in Icegram Email Subscribers & Newsletters Plugin for WordPress prior to version 4.5.6 allows a remote, unauthenticated attacker to conduct unauthenticated email forgery/spoofing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://www.tenable.com/security/research/tra-2020-53; https://www.tenable.com/security/research/tra-2020-53
CVE: CVE-2020-6097
Published: 2020-09-10
Description: An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-617, CWE-617
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00058.html; https://lists.debian.org/debian-lts-announce/2021/11/msg00014.html; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029
CVE: CVE-2020-8758
Published: 2020-09-10
Description: Improper buffer restrictions in network subsystem in provisioned Intel(R) AMT and Intel(R) ISM versions before 11.8.79, 11.12.79, 11.22.79, 12.0.68 and 14.0.39 may allow an unauthenticated user to potentially enable escalation of privilege via network access. On un-provisioned systems, an authenticated user may potentially enable escalation of privilege via local access.
CVSS Score: 9.8 (CRITICAL)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00404.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-17145
Published: 2020-09-10
Description: Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145; https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md; https://invdos.net
CVE: CVE-2020-10773
Published: 2020-09-10
Description: A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the /proc/sys/vm/cmm_timeout file. This flaw allows a local user to see the kernel data.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-626
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10773; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10773