deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-25246
Published: 2021-02-04
Description: An improper access control information disclosure vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG SP1, and Worry-Free Business Security could allow an unauthenticated user to create a bogus agent on an affected server that could be used then make valid configuration queries.
CVSS Score: 6.5 (MEDIUM)
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25248
Published: 2021-02-04
Description: An out-of-bounds read information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1 and Services) could allow an attacker to disclose sensitive information about a named pipe. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2021-25249
Published: 2021-02-04
Description: An out-of-bounds write information disclosure vulnerability in Trend Micro Apex One (on-prem and SaaS), OfficeScan XG SP1, and Worry-Free Business Security (10.0 SP1 and Services) could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://success.trendmicro.com/solution/000284202; https://success.trendmicro.com/solution/000284205; https://success.trendmicro.com/solution/000284206
CVE: CVE-2020-10537
Published: 2021-02-05
Description: An issue was discovered in Epikur before 20.1.1. A Glassfish 4.1 server with a default configuration is running on TCP port 4848. No password is required to access it with the administrator account.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306
References: https://www.x41-dsec.de/lab/advisories/x41-2020-003-epikur; https://www.x41-dsec.de/lab/advisories/x41-2020-003-epikur
CVE: CVE-2020-10538
Published: 2021-02-05
Description: An issue was discovered in Epikur before 20.1.1. It stores the secret passwords of the users as MD5 hashes in the database. MD5 can be brute-forced efficiently and should not be used for such purposes. Additionally, since no salt is used, rainbow tables can speed up the attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-916
References: https://www.x41-dsec.de/lab/advisories/x41-2020-003-epikur; https://www.x41-dsec.de/lab/advisories/x41-2020-003-epikur
CVE: CVE-2020-10539
Published: 2021-02-05
Description: An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user (aka a "Backdoor Password" of 3p1kursupport). If the submitted password matches either one, access is granted.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://www.x41-dsec.de/lab/advisories/x41-2020-003-epikur; https://www.x41-dsec.de/lab/advisories/x41-2020-003-epikur
CVE: CVE-2020-18713
Published: 2021-02-05
Description: SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.seebug.org/vuldb/ssvid-97859; https://www.seebug.org/vuldb/ssvid-97859
CVE: CVE-2020-18714
Published: 2021-02-05
Description: SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.seebug.org/vuldb/ssvid-97858; https://www.seebug.org/vuldb/ssvid-97858
CVE: CVE-2020-18715
Published: 2021-02-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-18716
Published: 2021-02-05
Description: SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.seebug.org/vuldb/ssvid-97867; https://www.seebug.org/vuldb/ssvid-97867
CVE: CVE-2020-18717
Published: 2021-02-05
Description: SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.seebug.org/vuldb/ssvid-98031; https://www.seebug.org/vuldb/ssvid-98031
CVE: CVE-2020-35765
Published: 2021-02-05
Description: doFilter in com.adventnet.appmanager.filter.UriCollector in Zoho ManageEngine Applications Manager through 14930 allows an authenticated SQL Injection via the resourceid parameter to showresource.do.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.manageengine.com; https://www.manageengine.com/products/applications_manager/issues.html#v15000; https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2020-35765.html
CVE: CVE-2020-36241
Published: 2021-02-05
Description: autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22, CWE-59
References: https://gitlab.gnome.org/GNOME/gnome-autoar/-/commit/adb067e645732fdbe7103516e506d09eb6a54429; https://gitlab.gnome.org/GNOME/gnome-autoar/-/issues/7; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN5TVQ7OHZEGY6AGFLAZWCVCI53RYNHQ/
CVE: CVE-2020-8806
Published: 2021-02-05
Description: Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected because timestamp requirements on block headers were not properly enforced.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://electriccoin.co/blog/new-releases-2-1-1-and-hotfix-2-1-1-1/; https://electriccoin.co/blog/new-releases-2-1-1-and-hotfix-2-1-1-1/
CVE: CVE-2020-8807
Published: 2021-02-05
Description: In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel.
CVSS Score: 5.3 (MEDIUM)
References: https://electriccoin.co/blog/new-releases-2-1-1-and-hotfix-2-1-1-1/; https://electriccoin.co/blog/new-releases-2-1-1-and-hotfix-2-1-1-1/
CVE: CVE-2021-20623
Published: 2021-02-05
Description: Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially crafted request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: http://downloadvi.com/downloads/IPServer/v7.8/780182/v780182RN.pdf; https://jvn.jp/en/jp/JVN42252698/index.html; http://downloadvi.com/downloads/IPServer/v7.8/780182/v780182RN.pdf
CVE: CVE-2021-20652
Published: 2021-02-05
Description: Cross-site request forgery (CSRF) vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN50470170/index.html; https://wordpress.org/plugins/name-directory/; https://jvn.jp/en/jp/JVN50470170/index.html
CVE: CVE-2021-26708
Published: 2021-02-05
Description: A local privilege escalation was discovered in the Linux kernel before 5.10.13. Multiple race conditions in the AF_VSOCK implementation are caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in the commits that added VSOCK multi-transport support.
CVSS Score: 7.0 (HIGH)
CWE: CWE-667
References: http://www.openwall.com/lists/oss-security/2021/02/05/6; http://www.openwall.com/lists/oss-security/2021/04/09/2; http://www.openwall.com/lists/oss-security/2022/01/25/14
CVE: CVE-2021-26710
Published: 2021-02-05
Description: A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://vict0ni.me/redwood-report2web-xss-and-frame-injection/; https://vict0ni.me/report2web-xss-frame-injection.html; https://vict0ni.me/redwood-report2web-xss-and-frame-injection/
CVE: CVE-2021-26711
Published: 2021-02-05
Description: A frame-injection issue in the online help in Redwood Report2Web 4.3.4.5 allows remote attackers to render an external resource inside a frame via the help/Online_Help/NetHelp/default.htm turl parameter.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-610
References: https://vict0ni.me/redwood-report2web-xss-and-frame-injection/; https://vict0ni.me/report2web-xss-frame-injection.html; https://vict0ni.me/redwood-report2web-xss-and-frame-injection/
CVE: CVE-2021-3311
Published: 2021-02-05
Description: An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-613
References: https://anisiosantos.me/october-cms-token-reactivation; https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024; https://octobercms.com/forum/chan/announcements
CVE: CVE-2021-3333
Published: 2021-02-05
Description: Opmantek Open-AudIT 4.0.1 is affected by cross-site scripting (XSS). When outputting SQL statements for debugging, a maliciously crafted query can trigger an XSS attack. This attack only succeeds if the user is already logged in to Open-AudIT before they click the malicious link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://community.opmantek.com/display/OA/Errata+-+4.0.1+XSS+in+SQL+debugging+output; https://community.opmantek.com/display/OA/Errata+-+4.0.1+XSS+in+SQL+debugging+output
CVE: CVE-2020-4832
Published: 2021-02-05
Description: IBM PowerHA 7.2 could allow a local attacker to obtain sensitive information from temporary directories after a discovery failure occurs. IBM X-Force ID: 189969.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/189969; https://www.ibm.com/support/pages/node/6412283; https://exchange.xforce.ibmcloud.com/vulnerabilities/189969
CVE: CVE-2020-18737
Published: 2021-02-05
Description: An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/typora/typora-issues/issues/2289; https://github.com/typora/typora-issues/issues/2289
CVE: CVE-2021-3258
Published: 2021-02-05
Description: Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS), which may lead to arbitrary remote code execution.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/q2a-projects/Q2A-Ultimate-SEO/commit/20069f28147c6f2c3acca4e3f6f5154537c5d536; https://nirmaldahal.com.np/sxss-to-defacement-and-account-takeover/; https://www.question2answer.org/qa/58520/important-q2a-ultimate-seo-important-update
CVE: CVE-2021-3382
Published: 2021-02-05
Description: Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://github.com/go-gitea/gitea/pull/14390; https://github.com/go-gitea/gitea/pull/14390
CVE: CVE-2021-26722
Published: 2021-02-05
Description: LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/linkedin/oncall/issues/341; https://github.com/linkedin/oncall/issues/341
CVE: CVE-2020-10234
Published: 2021-02-05
Description: The AscRegistryFilter.sys kernel driver in IObit Advanced SystemCare 13.2 allows an unprivileged user to send an IOCTL to the device driver. If the user provides a NULL entry for the dwIoControlCode parameter, a kernel panic (aka BSOD) follows. The IOCTL codes can be found in the dispatch function: 0x8001E000, 0x8001E004, 0x8001E008, 0x8001E00C, 0x8001E010, 0x8001E014, 0x8001E020, 0x8001E024, 0x8001E040, 0x8001E044, and 0x8001E048. \DosDevices\AscRegistryFilter and \Device\AscRegistryFilter are affected.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/FULLSHADE/Kernel-exploits; https://github.com/FULLSHADE/Kernel-exploits/tree/master/AscRegistryFilter.sys; https://www.iobit.com/en/advancedsystemcarefree.php
CVE: CVE-2020-18750
Published: 2021-02-05
Description: Buffer overflow in pdf2json 0.69 allows local users to execute arbitrary code by converting a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://github.com/flexpaper/pdf2json/commit/80bf71f16c804108fd933e267fe31692aaa509b4; https://github.com/flexpaper/pdf2json/issues/22; https://github.com/flexpaper/pdf2json/commit/80bf71f16c804108fd933e267fe31692aaa509b4
CVE: CVE-2020-9014
Published: 2021-02-05
Description: In Epson iProjection v2.30, the driver file (EMP_NSAU.sys) allows local users to cause a denial of service (BSOD) via crafted input to the virtual audio device driver with IOCTL 0x9C402402, 0x9C402406, or 0x9C40240A. \Device\EMPNSAUIO and \DosDevices\EMPNSAU are similarly affected.
CVSS Score: 5.5 (MEDIUM)
References: https://epson.com/Support/wa00935; https://epson.com/wireless-projector-app; https://github.com/FULLSHADE/Kernel-exploits
CVE: CVE-2020-10375
Published: 2021-02-05
Description: An issue was discovered in New Media Smarty before 9.10. Passwords are stored in the database in an obfuscated format that can be easily reversed. The file data.mdb contains these obfuscated passwords in the second column. NOTE: this is unrelated to the popular Smarty template engine product.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-326
References: https://www.smarty-online.de; https://www.x41-dsec.de/lab/advisories/x41-2020-005-smarty/; https://www.smarty-online.de
CVE: CVE-2020-10552
Published: 2021-02-05
Description: An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and password masterke after installation. This allows any user to access it and read and modify the contents, including passwords. Local database files can be accessed directly as well.
CVSS Score: 8.1 (HIGH)
CWE: CWE-1188
References: https://www.x41-dsec.de/lab/advisories/x41-2020-002-psyprax; https://www.x41-dsec.de/lab/advisories/x41-2020-002-psyprax
CVE: CVE-2020-10553
Published: 2021-02-05
Description: An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka screensaver) of the application. If that entry is removed, the lockscreen is no longer displayed and the app is no longer locked. All local users are able to modify that file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://www.x41-dsec.de/lab/advisories/x41-2020-002-psyprax; https://www.x41-dsec.de/lab/advisories/x41-2020-002-psyprax
CVE: CVE-2020-10554
Published: 2021-02-05
Description: An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, which can be easily reverted. For example, the password AAAAAAAA is stored in the database as MMMMMMMM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326, CWE-522
References: https://www.x41-dsec.de/lab/advisories/x41-2020-002-psyprax; https://www.x41-dsec.de/lab/advisories/x41-2020-002-psyprax
CVE: CVE-2020-10857
Published: 2021-02-05
Description: Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content, leading to remote code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://blog.zulip.com/2020/04/01/zulip-desktop-5-0-0-security-release/; https://blog.zulip.com/2020/04/01/zulip-desktop-5-0-0-security-release/
CVE: CVE-2020-10858
Published: 2021-02-05
Description: Zulip Desktop before 5.0.0 allows attackers to perform recording via the webcam and microphone due to a missing permission request handler.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://blog.zulip.com/2020/04/01/zulip-desktop-5-0-0-security-release/; https://blog.zulip.com/2020/04/01/zulip-desktop-5-0-0-security-release/
CVE: CVE-2020-12122
Published: 2021-02-05
Description: In Max Secure Max Spyware Detector 1.0.0.044, the driver file (MaxProc64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x2200019. (This also extends to the various other products from Max Secure that include MaxProc64.sys.)
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://github.com/FULLSHADE/Kernel-exploits; https://github.com/FULLSHADE/Kernel-exploits/tree/master/MaxProc64.sys; https://www.maxpcsecure.com/spywaredetector.htm
CVE: CVE-2020-9453
Published: 2021-02-05
Description: In Epson iProjection v2.30, the driver file EMP_MPAU.sys allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x9C402406 and IOCtl 0x9C40240A. (0x9C402402 has only a NULL pointer dereference.) This affects \Device\EMPMPAUIO and \DosDevices\EMPMPAU.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://epson.com; https://epson.com/Support/wa00936; https://github.com/FULLSHADE/Kernel-exploits
CVE: CVE-2021-1072
Published: 2021-02-05
Description: NVIDIA GeForce Experience, all versions prior to 3.21, contains a vulnerability in GameStream (rxdiag.dll) where an arbitrary file deletion due to improper handling of log files may lead to denial of service.
CVSS Score: 6.0 (MEDIUM)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5155; https://nvidia.custhelp.com/app/answers/detail/a_id/5155
CVE: CVE-2021-21303
Published: 2021-02-05
Description: Helm is open-source software which is essentially "The Kubernetes Package Manager". Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. In Helm from version 3.0 and before version 3.5.2, there a few cases where data loaded from potentially untrusted sources was not properly sanitized. When a SemVer in the `version` field of a chart is invalid, in some cases Helm allows the string to be used "as is" without sanitizing. Helm fails to properly sanitized some fields present on Helm repository `index.yaml` files. Helm does not properly sanitized some fields in the `plugin.yaml` file for plugins In some cases, Helm does not properly sanitize the fields in the `Chart.yaml` file. By exploiting these attack vectors, core maintainers were able to send deceptive information to a terminal screen running the `helm` command, as well as obscure or alter information on the screen. In some cases, we could send codes that terminals used to execute higher-order logic, like clearing a terminal screen. Further, during evaluation, the Helm maintainers discovered a few other fields that were not properly sanitized when read out of repository index files. This fix remedies all such cases, and once again enforces SemVer2 policies on version fields. All users of the Helm 3 should upgrade to the fixed version 3.5.2 or later. Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sanitize the data.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-74
References: https://github.com/helm/helm/commit/6ce9ba60b73013857e2e7c73d3f86ed70bc1ac9a; https://github.com/helm/helm/releases/tag/v3.5.2; https://github.com/helm/helm/security/advisories/GHSA-c38g-469g-cmgx
CVE: CVE-2021-3229
Published: 2021-02-05
Description: Denial of service in ASUSWRT ASUS RT-AX3000 firmware versions 3.0.0.4.384_10177 and earlier versions allows an attacker to disrupt the use of device setup services via continuous login error.
CVSS Score: 7.5 (HIGH)
References: https://dlcdnimgs.asus.com/websites/global/productcustomizedTab/562/ASUSWRT%20portal%20feature.pdf; https://github.com/fullbbadda1208/CVE-2021-3229; https://www.asus.com/us/ASUSWRT/
CVE: CVE-2020-11836
Published: 2021-02-06
Description: OPPO Android Phone with MTK chipset and Android 8.1/9/10/11 versions have an information leak vulnerability. The “adb shell getprop ro.vendor.aee.enforcing” or “adb shell getprop ro.vendor.aee.enforcing” return no.
CVSS Score: 5.5 (MEDIUM)
References: https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]449617920; https://security.oppo.com/en/noticeDetail?notice_only_key=NOTICE[PII_REDACTED]449617920
CVE: CVE-2020-14312
Published: 2021-02-06
Description: A flaw was found in the default configuration of dnsmasq, as shipped with Fedora versions prior to 31 and in all versions Red Hat Enterprise Linux, where it listens on any interface and accepts queries from addresses outside of its local subnet. In particular, the option `local-service` is not enabled. Running dnsmasq in this manner may inadvertently make it an open resolver accessible from any address on the internet. This flaw allows an attacker to conduct a Distributed Denial of Service (DDoS) against other systems.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-284
References: https://bugzilla.redhat.com/show_bug.cgi?id=1851342; https://bugzilla.redhat.com/show_bug.cgi?id=1851342
CVE: CVE-2020-5812
Published: 2021-02-06
Description: Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://www.tenable.com/security/tns-2021-01; https://www.tenable.com/security/tns-2021-01
CVE: CVE-2021-20176
Published: 2021-02-06
Description: A divide-by-zero flaw was found in ImageMagick 6.9.11-57 and 7.0.10-57 in gem.c. This flaw allows an attacker who submits a crafted file that is processed by ImageMagick to trigger undefined behavior through a division by zero. The highest threat from this vulnerability is to system availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-369
References: https://bugzilla.redhat.com/show_bug.cgi?id=1916610; https://lists.debian.org/debian-lts-announce/2021/03/msg00030.html; https://lists.debian.org/debian-lts-announce/2023/05/msg00020.html
CVE: CVE-2021-22301
Published: 2021-02-06
Description: Mate 30 10.0.0.203(C00E201R7P2) have a buffer overflow vulnerability. After obtaining the root permission, an attacker can exploit the vulnerability to cause buffer overflow.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210127-01-buffer-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210127-01-buffer-en
CVE: CVE-2021-22307
Published: 2021-02-06
Description: There is a weak algorithm vulnerability in Mate 3010.0.0.203(C00E201R7P2). The protection is insufficient for the modules that should be protected. Local attackers can exploit this vulnerability to affect the integrity of certain module.
CVSS Score: 5.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210127-06-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210127-06-smartphone-en