deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4645
Published: 2020-07-29
Description: IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 185717.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185717; https://www.ibm.com/support/pages/node/6253355; https://exchange.xforce.ibmcloud.com/vulnerabilities/185717
CVE: CVE-2020-16095
Published: 2020-07-29
Description: The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://typo3.org/help/security-advisories; https://typo3.org/security/advisory/typo3-ext-sa-2020-015; https://typo3.org/help/security-advisories
CVE: CVE-2020-8553
Published: 2020-07-29
Description: The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://github.com/kubernetes/ingress-nginx/issues/5126; https://github.com/kubernetes/ingress-nginx/issues/5126
CVE: CVE-2020-13699
Published: 2020-07-29
Description: TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated by a teamviewer10: --play URL. An attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking. This affects teamviewer10, teamviewer8, teamviewerapi, tvchat1, tvcontrol1, tvfiletransfer1, tvjoinv8, tvpresent1, tvsendfile1, tvsqcustomer1, tvsqsupport1, tvvideocall1, and tvvpn1. The issue is fixed in 8.0.258861, 9.0.258860, 10.0.258873, 11.0.258870, 12.0.258869, 13.2.36220, 14.2.56676, 14.7.48350, and 15.8.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-88
References: https://community.teamviewer.com/t5/Announcements/Statement-on-CVE-2020-13699/td-p/98448; https://jeffs.sh/CVEs/CVE-2020-13699.txt; https://community.teamviewer.com/t5/Announcements/Statement-on-CVE-2020-13699/td-p/98448
CVE: CVE-2020-11933
Published: 2020-07-29
Description: cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security mechanisms such as full disk encryption. This issue did not affect traditional Ubuntu systems. Fixed in snapd version 2.45.2, revision 8539 and core version 2.45.2, revision 9659.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264
References: https://launchpad.net/bugs/1879530; https://ubuntu.com/USN-4424-1; https://launchpad.net/bugs/1879530
CVE: CVE-2020-11934
Published: 2020-07-29
Description: It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-668
References: https://launchpad.net/bugs/1880085; https://ubuntu.com/USN-4424-1; https://launchpad.net/bugs/1880085
CVE: CVE-2020-15086
Published: 2020-07-29
Description: In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-200, CWE-325, CWE-502
References: https://github.com/FriendsOfTYPO3/mediace/commit/fa29ffd3e8b275782a8600d2406e1b1e5e16ae75; https://github.com/FriendsOfTYPO3/mediace/pull/31; https://github.com/FriendsOfTYPO3/mediace/security/advisories/GHSA-4h44-w6fm-548g
CVE: CVE-2020-15098
Published: 2020-07-29
Description: In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation, insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-200, CWE-325, CWE-502, CWE-327
References: https://github.com/TYPO3/TYPO3.CMS/commit/85d3e70dff35a99ef53f4b561114acfa9e5c47e1; https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-m5vr-3m74-jwxp; https://typo3.org/security/advisory/typo3-core-sa-2016-013
CVE: CVE-2020-15099
Published: 2020-07-29
Description: In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php, which again contains the encryptionKey as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network, this allows the ability to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. This has been patched in versions 9.5.20 and 10.4.6.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20, CWE-200, CWE-20
References: https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-3x94-fv5h-5q2c; https://typo3.org/security/advisory/typo3-core-sa-2020-007; https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-3x94-fv5h-5q2c
CVE: CVE-2020-15125
Published: 2020-07-29
Description: In auth0 (npm package) versions before 2.27.1, a DenyList of specific keys that should be sanitized from the request object contained in the error object is used. The key for Authorization header is not sanitized and in certain cases the Authorization header value can be logged exposing a bearer token. You are affected by this vulnerability if you are using the auth0 npm package, and you are using a Machine to Machine application authorized to use Auth0's management API
CVSS Score: 7.7 (HIGH)
CWE: CWE-209, CWE-209
References: https://github.com/auth0/node-auth0/pull/507; https://github.com/auth0/node-auth0/pull/507/commits/62ca61b3348ec8e74d7d00358661af1a8bc98a3c; https://github.com/auth0/node-auth0/security/advisories/GHSA-5jpf-pj32-xx53
CVE: CVE-2019-20025
Published: 2020-07-29
Description: Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcoded username and password, aka a Static Credential Vulnerability. The vulnerability is due to an undocumented user account with manufacturer privilege level. An attacker could exploit this vulnerability by using this account to remotely log into an affected device. A successful exploit could allow the attacker to log into the device with manufacturer level access. This vulnerability affects SV9100 PBXes that are running software release 6.0 or higher. This vulnerability does not affect SV9100 software releases prior to 6.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20026
Published: 2020-07-29
Description: The WebPro interface in NEC SV9100 software releases 7.0 or higher allows unauthenticated remote attackers to reset all existing usernames and passwords to default values via a crafted request.
CVSS Score: 7.5 (HIGH)
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20027
Published: 2020-07-29
Description: Aspire-derived NEC PBXes, including the SV8100, SV9100, SL1100 and SL2100 with software releases 7.0 or higher contain the possibility if incorrectly configured to allow a blank username and password combination to be entered as a valid, successfully authenticating account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20028
Published: 2020-07-29
Description: Aspire-derived NEC PBXes operating InMail software, including all versions of SV8100, SV9100, SL1100 and SL2100 devices allow unauthenticated read-only access to voicemails, greetings, and voice response system content through a system's WebPro administration interface.
CVSS Score: 7.5 (HIGH)
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20029
Published: 2020-07-29
Description: An exploitable privilege escalation vulnerability exists in the WebPro functionality of Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices. A specially crafted HTTP POST can cause privilege escalation resulting in a higher privileged account, including an undocumented developer level of access.
CVSS Score: 8.8 (HIGH)
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20030
Published: 2020-07-29
Description: An attacker with knowledge of the modem access number on a NEC UM8000 voicemail system may use SSH tunneling or standard Linux utilities to gain access to the system's LAN port. All versions are affected.
CVSS Score: 7.8 (HIGH)
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20031
Published: 2020-07-29
Description: NEC UM8000, UM4730 and prior non-InMail voicemail systems with all known software versions may permit an infinite number of login attempts in the telephone user interface (TUI), effectively allowing brute force attacks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-307
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20032
Published: 2020-07-29
Description: An attacker with access to an InMail voicemail box equipped with the find me/follow me feature on Aspire-derived NEC PBXes, including all versions of SV8100, SV9100, SL1100 and SL2100 devices, may access the system's administration modem.
CVSS Score: 6.5 (MEDIUM)
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2019-20033
Published: 2020-07-29
Description: On Aspire-derived NEC PBXes, including all versions of SV8100 devices, a set of documented, static login credentials may be used to access the DIM interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://shadytel.su/files/nec_cve.txt; https://shadytel.su/files/nec_cve.txt
CVE: CVE-2020-15588
Published: 2020-07-29
Description: An issue was discovered in the client side of Zoho ManageEngine Desktop Central 10.0.552.W. An attacker-controlled server can trigger an integer overflow in InternetSendRequestEx and InternetSendRequestByBitrate that leads to a heap-based buffer overflow and Remote Code Execution with SYSTEM privileges. This issue will occur only when untrusted communication is initiated with server. In cloud, Agent will always connect with trusted communication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html; https://www.manageengine.com/products/desktop-central/integer-overflow-vulnerability.html
CVE: CVE-2020-15705
Published: 2020-07-29
Description: GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00067.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00069.html; http://ubuntu.com/security/notices/USN-4432-1
CVE: CVE-2020-15706
Published: 2020-07-29
Description: GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-362, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html; http://ubuntu.com/security/notices/USN-4432-1
CVE: CVE-2020-15707
Published: 2020-07-29
Description: Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-362, CWE-190, CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html; http://ubuntu.com/security/notices/USN-4432-1
CVE: CVE-2020-16117
Published: 2020-07-29
Description: In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/2cc39592b532cf0dc994fd3694b8e6bf924c9ab5; https://gitlab.gnome.org/GNOME/evolution-data-server/-/commit/627c3cdbfd077e59aa288c85ff[PII_REDACTED]f1d7; https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/189
CVE: CVE-2020-16118
Published: 2020-07-29
Description: In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00035.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00045.html; https://gitlab.gnome.org/GNOME/balsa/-/commit/4e245d758e1c826a01080d40c22ca8706f0339e5
CVE: CVE-2020-14316
Published: 2020-07-29
Description: A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 9.9 (CRITICAL)
References: https://bugzilla.redhat.com/show_bug.cgi?id=1848951; https://bugzilla.redhat.com/show_bug.cgi?id=1848951
CVE: CVE-2020-5760
Published: 2020-07-29
Description: Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.tenable.com/security/research/tra-2020-43; https://www.tenable.com/security/research/tra-2020-47; https://www.tenable.com/security/research/tra-2020-43
CVE: CVE-2020-5761
Published: 2020-07-29
Description: Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated remote attackers can trigger this case by sending a one character TCP message to the TR-069 service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835, CWE-835
References: https://www.tenable.com/security/research/tra-2020-43; https://www.tenable.com/security/research/tra-2020-47; https://www.tenable.com/security/research/tra-2020-43
CVE: CVE-2020-5762
Published: 2020-07-29
Description: Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of the HTTP Authentication field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://www.tenable.com/security/research/tra-2020-43; https://www.tenable.com/security/research/tra-2020-47; https://www.tenable.com/security/research/tra-2020-43
CVE: CVE-2020-5763
Published: 2020-07-29
Description: Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by correctly answering a challenge prompt.
CVSS Score: 8.8 (HIGH)
CWE: CWE-489, CWE-326
References: https://www.tenable.com/security/research/tra-2020-43; https://www.tenable.com/security/research/tra-2020-47; https://www.tenable.com/security/research/tra-2020-43
CVE: CVE-2017-18923
Published: 2020-07-29
Description: beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://beronet.atlassian.net/wiki/spaces/PUB/pages/88768529/Security+Issues; https://www.heise.de/security/meldung/Angriffe-auf-VoIP-Gateways-von-beroNet-Patch-sorgt-fuer-Sicherheit-3594737.html; https://beronet.atlassian.net/wiki/spaces/PUB/pages/88768529/Security+Issues
CVE: CVE-2020-14308
Published: 2020-07-29
Description: In grub2 versions before 2.06 the grub memory allocator doesn't check for possible arithmetic overflows on the requested allocation size. This leads the function to return invalid memory allocations which can be further used to cause possible integrity, confidentiality and availability impacts during the boot process.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html; http://www.openwall.com/lists/oss-security/2020/07/29/3
CVE: CVE-2020-16135
Published: 2020-07-29
Description: libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476
References: https://bugs.libssh.org/T232; https://bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238; https://gitlab.com/libssh/libssh-mirror/-/merge_requests/120
CVE: CVE-2020-16143
Published: 2020-07-29
Description: The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://github.com/haiwen/seafile-client/issues/1309; https://github.com/haiwen/seafile-client/issues/1309
CVE: CVE-2020-5610
Published: 2020-07-30
Description: Global TechStream (GTS) for TOYOTA dealers version 15.10.032 and earlier allows an attacker to cause a denial-of-service (DoS) condition and execute arbitrary code via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/jp/JVN40400577/index.html; https://jvn.jp/en/jp/JVN40400577/index.html
CVE: CVE-2020-7699
Published: 2020-07-30
Description: This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://github.com/richardgirges/express-fileupload/issues/236; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969
CVE: CVE-2019-10580
Published: 2020-07-30
Description: When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9607, MSM8909W, Nicobar, QCM2150, QCS405, QCS605, Saipan, SC8180X, SDM429W, SDX55, SM8150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2019-14037
Published: 2020-07-30
Description: Close and bind operations done on a socket can lead to a Use-After-Free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8996, MSM8996AU, QCN7605, QCN7606, QCS605, SC8180X, SDA660, SDA845, SDM439, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM8150, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2019-14093
Published: 2020-07-30
Description: Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, QCM2150, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM636, SDM660, SDX20
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin