deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-4685
Published: 2020-11-11
Description: A low level user of IBM Cognos Controller 10.3.0, 10.3.1, 10.4.0, 10.4.1, and 10.4.2 who has Administration rights to the server where the application is installed, can escalate their privilege from Low level to Super Admin and gain access to Create/Update/Delete any level of user in Cognos Controller. IBM X-Force ID: 186625.
CVSS Score: 7.2 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/186625; https://www.ibm.com/support/pages/node/6339995; https://exchange.xforce.ibmcloud.com/vulnerabilities/186625
CVE: CVE-2020-27523
Published: 2020-11-11
Description: Solstice-Pod up to 5.0.2 WEBRTC server mishandles the format-string specifiers %x; %p; %c and %s in the screen_key, display_name, browser_name, and operation_system parameter during the authentication process. This may crash the server and force Solstice-Pod to reboot, which leads to a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: https://documentation.mersive.com/content/topics/general-gen2i-pod-specs.htm; https://tiger-team-1337.blogspot.com/2020/10/solstice-pod-critical-unauthenticated.html; https://twitter.com/Kevin2600/status/[PII_REDACTED]03275264
CVE: CVE-2020-27524
Published: 2020-11-11
Description: On Audi A7 MMI 2014 vehicles, the Bluetooth stack in Audi A7 MMI Multiplayer with version (N+R_CN_AU_P0395) mishandles %x and %s format string specifiers in a device name. This may lead to memory content leaks and potentially crash the services.
CVSS Score: 7.1 (HIGH)
CWE: CWE-134
References: https://tiger-team-1337.blogspot.com/2020/10/audi-a7-2014-mmi-mishandles-format.html; https://twitter.com/Kevin2600/status/[PII_REDACTED]93571840; https://www.youtube.com/watch?v=BQUVgAdhwQs
CVE: CVE-2020-15275
Published: 2020-11-11
Description: MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://advisory.checkmarx.net/advisory/CX-2020-4285; https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e[PII_REDACTED]9b4a0b2a88a2; https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11
CVE: CVE-2020-5426
Published: 2020-11-11
Description: Scheduler for TAS prior to version 1.4.0 was permitting plaintext transmission of UAA client token by sending it over a non-TLS connection. This also depended on the configuration of the MySQL server which is used to cache a UAA client token used by the service. If intercepted the token can give an attacker admin level access in the cloud controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319, CWE-319
References: https://tanzu.vmware.com/security/cve-2020-5426; https://tanzu.vmware.com/security/cve-2020-5426
CVE: CVE-2020-8352
Published: 2020-11-11
Description: In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.
CVSS Score: 2.4 (LOW)
CWE: CWE-358
References: https://support.lenovo.com/us/en/product_security/LEN-49266; https://support.lenovo.com/us/en/product_security/LEN-49266
CVE: CVE-2020-8353
Published: 2020-11-11
Description: Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-16
References: https://support.lenovo.com/us/en/product_security/LEN-44725; https://support.lenovo.com/us/en/product_security/LEN-44725
CVE: CVE-2020-8354
Published: 2020-11-11
Description: A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrary code execution.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367
References: https://support.lenovo.com/us/en/product_security/LEN-49266; https://support.lenovo.com/us/en/product_security/LEN-49266
CVE: CVE-2020-26218
Published: 2020-11-11
Description: touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79, CWE-80, CWE-79
References: https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-r4w5-gw36-4792; https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-r4w5-gw36-4792
CVE: CVE-2020-26219
Published: 2020-11-11
Description: touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to the redirection to malicious websites containing attacker-controlled content, which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first, the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-601
References: https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x; https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-6wcq-7r33-gw8x
CVE: CVE-2020-26220
Published: 2020-11-11
Description: toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other users could obtain its geolocation, device, and software version data etc (if present. The issue is fixed in version 2.0.
CVSS Score: 3.5 (LOW)
CWE: CWE-200
References: https://github.com/puncsky/touchbase.ai/pull/400/commits/69de77b163f6debaeb3f8d1a85367310a40d196f; https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-hh6j-j73p-cp3h; https://github.com/puncsky/touchbase.ai/pull/400/commits/69de77b163f6debaeb3f8d1a85367310a40d196f
CVE: CVE-2020-26221
Published: 2020-11-11
Description: touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScript code which could result in hijacking of the user's cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser action. The issue is patched in version 2.0.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-jc3v-h36h-6mx3; https://github.com/puncsky/touchbase.ai/security/advisories/GHSA-jc3v-h36h-6mx3
CVE: CVE-2020-5992
Published: 2020-11-11
Description: NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software dependency in which the OpenSSL library is vulnerable to binary planting attacks by a local user, which may lead to code execution or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5096; https://nvidia.custhelp.com/app/answers/detail/a_id/5096
CVE: CVE-2020-1999
Published: 2020-11-12
Description: A vulnerability exists in the Palo Alto Network PAN-OS signature-based threat detection engine that allows an attacker to communicate with devices in the network in a way that is not analyzed for threats by sending data through specifically crafted TCP packets. This technique evades signature-based threat detection. This issue impacts: PAN-OS 8.1 versions earlier than 8.1.17; PAN-OS 9.0 versions earlier than 9.0.11; PAN-OS 9.1 versions earlier than 9.1.5; All versions of PAN-OS 7.1 and PAN-OS 8.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://security.paloaltonetworks.com/CVE-2020-1999; https://security.paloaltonetworks.com/CVE-2020-1999
CVE: CVE-2020-2000
Published: 2020-11-12
Description: An OS command injection and memory corruption vulnerability in the PAN-OS management web interface that allows authenticated administrators to disrupt system processes and potentially execute arbitrary code and OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.4; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-78, CWE-121, CWE-78
References: https://security.paloaltonetworks.com/CVE-2020-2000; https://security.paloaltonetworks.com/CVE-2020-2000
CVE: CVE-2020-2022
Published: 2020-11-12
Description: An information exposure vulnerability exists in Palo Alto Networks Panorama software that discloses the token for the Panorama web interface administrator's session to a managed device when the Panorama administrator performs a context switch into that device. This vulnerability allows an attacker to gain privileged access to the Panorama web interface. An attacker requires some knowledge of managed firewalls to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-269
References: https://security.paloaltonetworks.com/CVE-2020-2022; https://security.paloaltonetworks.com/CVE-2020-2022
CVE: CVE-2020-2048
Published: 2020-11-12
Description: An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.2.
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-532
References: https://security.paloaltonetworks.com/CVE-2020-2048; https://security.paloaltonetworks.com/CVE-2020-2048
CVE: CVE-2020-2050
Published: 2020-11-12
Description: An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal is configured to rely entirely on certificate-based authentication. Impacted features that use SSL VPN with client certificate verification are: GlobalProtect Gateway, GlobalProtect Portal, GlobalProtect Clientless VPN In configurations where client certificate verification is used in conjunction with other authentication methods, the protections added by the certificate check are ignored as a result of this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.17; PAN-OS 9.0 versions earlier than PAN-OS 9.0.11; PAN-OS 9.1 versions earlier than PAN-OS 9.1.5; PAN-OS 10.0 versions earlier than PAN-OS 10.0.1.
CVSS Score: 8.2 (HIGH)
CWE: CWE-285, CWE-287
References: https://security.paloaltonetworks.com/CVE-2020-2050; https://security.paloaltonetworks.com/CVE-2020-2050
CVE: CVE-2020-26070
Published: 2020-11-12
Description: A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper resource allocation when an affected device processes network traffic in software switching mode (punted). An attacker could exploit this vulnerability by sending specific streams of Layer 2 or Layer 3 protocol data units (PDUs) to an affected device. A successful exploit could cause the affected device to run out of buffer resources, which could make the device unable to process or forward traffic, resulting in a DoS condition. The device would need to be restarted to regain functionality.
CVSS Score: 8.6 (HIGH)
CWE: CWE-404, CWE-404
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cp-dos-ej8VB9QY
CVE: CVE-2020-7769
Published: 2020-11-12
Description: This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
CVSS Score: 8.6 (HIGH)
CWE: CWE-88
References: https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75; https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742
CVE: CVE-2020-11121
Published: 2020-11-12
Description: u'Possible buffer overflow in WIFI hal process due to usage of memcpy without checking length of destination buffer' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile in QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SC8180X, SC8180XP, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11123
Published: 2020-11-12
Description: u'information disclosure in gatekeeper trustzone implementation as the throttling mechanism to prevent brute force attempts at getting user`s lock-screen password can be bypassed by performing the standard gatekeeper operations.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8009W, APQ8017, APQ8037, APQ8053, APQ8064AU, APQ8096, APQ8096AU, APQ8096SG, APQ8098, MDM8207, MDM9150, MDM9205, MDM9206, MDM9207, MDM9250, MDM9607, MDM9628, MDM9640, MDM9650, MDM9655, MSM8108, MSM8208, MSM8209, MSM8608, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8996SG, MSM8998, QCM4290, QCS405, QCS410, QCS4290, QCS603, QCS605, QCS610, QM215, QSM8250, QSM8350, SA415M, SA515M, SA6145P, SA6150P, SA6155, SA6155P, SA8150P, SA8155, SA8155P, SA8195P, SC7180, SC8180X, SC8180XP, SDA429W, SDA640, SDA660, SDA670, SDA845, SDA855, SDM1000, SDM429, SDM429W, SDM439, SDM450, SDM455, SDM630, SDM632, SDM636, SDM640, SDM660, SDM670, SDM710, SDM712, SDM830, SDM845, SDM850, SDW2500, SDX24, SDX50M, SDX55, SDX55M, SM4125, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6150, SM6150P, SM6250, SM6250P, SM6350, SM7125, SM7150, SM7150P, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR1120, SXR1130, SXR2130, SXR2130P, WCD9330
CVSS Score: 5.5 (MEDIUM)
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11127
Published: 2020-11-12
Description: u'Integer overflow can cause a buffer overflow due to lack of table length check in the extensible boot Loader during the validation of security metadata while processing objects to be loaded' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in MDM9205, QCM4290, QCS405, QCS410, QCS4290, QCS610, QSM8250, SA415M, SA515M, SA6145P, SA6150P, SA6155, SA6155P, SA8150P, SA8155, SA8155P, SA8195P, SC7180, SC8180X, SC8180X+SDX55, SC8180XP, SDA640, SDA845, SDA855, SDM1000, SDM640, SDM830, SDM845, SDM850, SDX24, SDX50M, SDX55, SDX55M, SM4125, SM4250, SM4250P, SM6115, SM6115P, SM6150, SM6150P, SM6250, SM6250P, SM6350, SM7125, SM7150, SM7150P, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SXR2130, SXR2130P
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11130
Published: 2020-11-12
Description: u'Possible buffer overflow in WIFI hal process due to copying data without checking the buffer length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile in QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SC8180X, SC8180XP, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11131
Published: 2020-11-12
Description: u'Possible buffer overflow in WMA message processing due to integer overflow occurs when processing command received from user space' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8009, APQ8053, APQ8096AU, MDM9206, MDM9250, MDM9628, MDM9640, MDM9650, MSM8996AU, QCS405, SDA845, SDX20, SDX20M, WCD9330
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11132
Published: 2020-11-12
Description: u'Buffer over read in boot due to size check ignored before copying GUID attribute from request to response' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8096AU, APQ8098, MDM8207, MDM9150, MDM9205, MDM9206, MDM9207, MDM9250, MDM9607, MDM9628, MDM9650, MSM8108, MSM8208, MSM8209, MSM8608, MSM8905, MSM8909, MSM8998, QCM4290, QCS405, QCS410, QCS4290, QCS603, QCS605, QCS610, QSM8250, SA415M, SA515M, SA6145P, SA6150P, SA6155, SA6155P, SA8150P, SA8155, SA8155P, SA8195P, SC7180, SC8180X, SC8180X+SDX55, SC8180XP, SDA640, SDA670, SDA845, SDA855, SDM1000, SDM640, SDM670, SDM710, SDM712, SDM830, SDM845, SDM850, SDX24, SDX50M, SDX55, SDX55M, SM4125, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6150, SM6150P, SM6250, SM6250P, SM6350, SM7125, SM7150, SM7150P, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SXR1120, SXR1130, SXR2130, SXR2130P, WCD9330
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11168
Published: 2020-11-12
Description: u'Null-pointer dereference can occur while accessing data buffer beyond its size that leads to access the buffer beyond its range' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8009W, APQ8017, APQ8053, APQ8064AU, APQ8096AU, APQ8098, MDM9206, MDM9650, MSM8909W, MSM8953, MSM8996AU, QCM4290, QCS405, QCS4290, QCS603, QCS605, QM215, QSM8350, SA6155, SA6155P, SA8155, SA8155P, SDA429W, SDA640, SDA660, SDA845, SDA855, SDM1000, SDM429, SDM429W, SDM450, SDM632, SDM640, SDM830, SDM845, SDW2500, SDX20, SDX20M, SDX50M, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P, WCD9330
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11175
Published: 2020-11-12
Description: u'Use after free issue in Bluetooth transport driver when a method in the object is accessed after the object has been deleted due to improper timer handling.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009W, MSM8909W, QCS605, QM215, SA6155, SA6155P, SA8155, SA8155P, SDA640, SDA670, SDA855, SDM1000, SDM640, SDM670, SDM710, SDM845, SDX50M, SDX55, SDX55M, SM6125, SM6350, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SXR1120, SXR1130, SXR2130, SXR2130P
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11184
Published: 2020-11-12
Description: u'Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile in QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11193
Published: 2020-11-12
Description: u'Buffer over read can happen while parsing mkv clip due to improper typecasting of data returned from atomsize' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8009W, APQ8017, APQ8037, APQ8053, APQ8064AU, APQ8096, APQ8096AU, APQ8096SG, APQ8098, MDM9206, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8996SG, MSM8998, QCM4290, QCM6125, QCS405, QCS410, QCS4290, QCS603, QCS605, QCS610, QCS6125, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDA429W, SDA640, SDA660, SDA670, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM455, SDM630, SDM632, SDM636, SDM640, SDM660, SDM670, SDM710, SDM830, SDM845, SDW2500, SDX20, SDX20M, SDX50M, SDX55, SDX55M, SM4125, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6150, SM6150P, SM6250, SM6250P, SM6350, SM7125, SM7150, SM7150P, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR1120, SXR1130, SXR2130, SXR2130P, WCD9330
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin
CVE: CVE-2020-11196
Published: 2020-11-12
Description: u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8009W, APQ8017, APQ8037, APQ8053, APQ8064AU, APQ8096, APQ8096AU, APQ8096SG, APQ8098, MDM9206, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8996SG, MSM8998, QCM4290, QCM6125, QCS405, QCS410, QCS4290, QCS603, QCS605, QCS610, QCS6125, QM215, SA6145P, SA6150P, SA6155, SA6155P, SA8150P, SA8155, SA8155P, SA8195P, SDA429W, SDA640, SDA660, SDA670, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM455, SDM630, SDM632, SDM636, SDM640, SDM660, SDM670, SDM710, SDM830, SDM845, SDW2500, SDX20, SDX20M, SDX50M, SDX55, SDX55M, SM4125, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6150, SM6150P, SM6250, SM6250P, SM6350, SM7125, SM7150, SM7150P, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SXR1120, SXR1130, SXR2130, SXR2130P, WCD9330
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin