deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14099
Published: 2020-07-30
Description: Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MSM8909W, MSM8917, MSM8953, Nicobar, QCM2150, QCS405, QCS605, QM215, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM632, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2019-14100
Published: 2020-07-30
Description: Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9207C, MDM9607, Nicobar, QCS405, SA6155P, SC8180X, SDX55, SM8150
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2019-14101
Published: 2020-07-30
Description: Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCN7605, QCS404, QCS405, QCS605, QM215, Rennell, SA415M, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2019-14123
Published: 2020-07-30
Description: Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-trustable in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-125, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2019-14124
Published: 2020-07-30
Description: Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-824
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2019-14130
Published: 2020-07-30
Description: Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2020-3671
Published: 2020-07-30
Description: Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8009, Nicobar, QCM2150, QCS405, Saipan, SDM845, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2020-3688
Published: 2020-07-30
Description: Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, Saipan, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2020-3698
Published: 2020-07-30
Description: Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCM2150, QCN7605, QCS405, QCS605, QM215, SA6155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX55, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2020-3699
Published: 2020-07-30
Description: Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCM2150, QCN7605, QCS405, QCS605, QM215, SA6155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2020-3700
Published: 2020-07-30
Description: Possible out of bounds read due to a missing bounds check and could lead to local information disclosure in the wifi driver with no additional execution privileges needed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCA9531, QCA9558, QCA9980, SC8180X, SDM439, SDX55, SM8150, SM8250, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2020-3701
Published: 2020-07-30
Description: Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon Mobile in Saipan, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin
CVE: CVE-2020-10713
Published: 2020-07-30
Description: A flaw was found in grub2, prior to version 2.06. An attacker may use the GRUB 2 flaw to hijack and tamper the GRUB verification process. This flaw also allows the bypass of Secure Boot protections. In order to load an untrusted or modified kernel, an attacker would first need to establish access to the system such as gaining physical access, obtain the ability to alter a pxe-boot network, or have remote access to a networked system with root access. With this access, an attacker could then craft a string to cause a buffer overflow by injecting a malicious payload that leads to arbitrary code execution within GRUB. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html; http://www.openwall.com/lists/oss-security/2020/07/29/3
CVE: CVE-2020-14309
Published: 2020-07-30
Description: There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.html; https://bugzilla.redhat.com/show_bug.cgi?id=1852022
CVE: CVE-2020-4185
Published: 2020-07-30
Description: IBM Security Guardium 10.5, 10.6, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 174803.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174803; https://www.ibm.com/support/pages/node/6254369; https://exchange.xforce.ibmcloud.com/vulnerabilities/174803
CVE: CVE-2020-4186
Published: 2020-07-30
Description: IBM Security Guardium 10.5, 10.6, and 11.1 could disclose sensitive information on the login page that could aid in further attacks against the system. IBM X-Force ID: 174804.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/174804; https://www.ibm.com/support/pages/node/6254367; https://exchange.xforce.ibmcloud.com/vulnerabilities/174804
CVE: CVE-2020-8192
Published: 2020-07-30
Description: A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://hackerone.com/reports/903521; https://hackerone.com/reports/903521
CVE: CVE-2020-8202
Published: 2020-07-30
Description: Improper check of inputs in Nextcloud Preferred Providers app v1.6.0 allowed to perform a denial of service attack when using a very long password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-307, CWE-307
References: https://hackerone.com/reports/840598; https://nextcloud.com/security/advisory/?id=NC-SA-2020-028; https://hackerone.com/reports/840598
CVE: CVE-2020-8204
Published: 2020-07-30
Description: A cross site scripting (XSS) vulnerability exists in Pulse Connect Secure <9.1R5 on the PSAL Page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8206
Published: 2020-07-30
Description: An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-287
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8213
Published: 2020-07-30
Description: An information exposure vulnerability exists in UniFi Protect before v1.13.4-beta.5 that allowed unauthenticated attackers access to valid usernames for the UniFi Protect web application via HTTP response code and response timing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-209, CWE-209
References: https://community.ui.com/releases/Security-advisory-bulletin-013-013/56d4d616-4afd-40ee-863f-319b7126ed84; https://community.ui.com/releases/Security-advisory-bulletin-013-013/56d4d616-4afd-40ee-863f-319b7126ed84
CVE: CVE-2020-8216
Published: 2020-07-30
Description: An information disclosure vulnerability in meeting of Pulse Connect Secure <9.1R8 allowed an authenticated end-users to find meeting details, if they know the Meeting ID.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8217
Published: 2020-07-30
Description: A cross site scripting (XSS) vulnerability in Pulse Connect Secure <9.1R8 allowed attackers to exploit in the URL used for Citrix ICA.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8218
Published: 2020-07-30
Description: A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8219
Published: 2020-07-30
Description: An insufficient permission check vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to change the password of a full administrator.
CVSS Score: 7.2 (HIGH)
CWE: CWE-280, CWE-276
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8220
Published: 2020-07-30
Description: A denial of service vulnerability exists in Pulse Connect Secure <9.1R8 that allows an authenticated attacker to perform command injection via the administrator web which can cause DOS.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8221
Published: 2020-07-30
Description: A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 which allows an authenticated attacker to read arbitrary files via the administrator web interface.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-8222
Published: 2020-07-30
Description: A path traversal vulnerability exists in Pulse Connect Secure <9.1R8 that allowed an authenticated attacker via the administrator web interface to perform an arbitrary file reading vulnerability through Meeting.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516; https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
CVE: CVE-2020-12620
Published: 2020-07-30
Description: Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address).
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://0xpanic.github.io/2020/07/21/Pihole.html; https://github.com/pi-hole/pi-hole; https://pi-hole.net/
CVE: CVE-2020-14158
Published: 2020-07-30
Description: The ABUS Secvest FUMO50110 hybrid module does not have any security mechanism that ensures confidentiality or integrity of RF packets that are exchanged with an alarm panel. This makes it easier to conduct wAppLoxx authentication-bypass attacks.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-287
References: http://packetstormsecurity.com/files/158692/ABUS-Secvest-Hybrid-Module-FUMO50110-Authentication-Bypass.html; http://seclists.org/fulldisclosure/2020/Jul/36; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-015.txt
CVE: CVE-2020-14162
Published: 2020-07-30
Description: An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-269
References: https://0xpanic.github.io/2020/07/21/Pihole.html; https://docs.pi-hole.net/core/pihole-command/; https://0xpanic.github.io/2020/07/21/Pihole.html
CVE: CVE-2020-15511
Published: 2020-07-30
Description: HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. Fixed in v202007-1.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.md; https://www.hashicorp.com/blog/category/terraform/; https://github.com/hashicorp/terraform-enterprise-release-notes/blob/master/v202007-1.md
CVE: CVE-2020-15957
Published: 2020-07-30
Description: An issue was discovered in DP3T-Backend-SDK before 1.1.1 for Decentralised Privacy-Preserving Proximity Tracing (DP3T). When it is configured to check JWT before uploading/publishing keys, it is possible to skip the signature check by providing a JWT token with alg=none.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/DP-3T/dp3t-sdk-backend/compare/v1.0.4...v1.1.0; https://github.com/DP-3T/dp3t-sdk-backend/security/advisories/GHSA-5m5q-3qw2-3xf3; https://github.com/dp-3T/dp3t-sdk-backend
CVE: CVE-2020-7827
Published: 2020-07-30
Description: DaviewIndy 8.98.7 and earlier version contain Use-After-Free vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35539; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35539
CVE: CVE-2020-7828
Published: 2020-07-30
Description: DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35539; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35539
CVE: CVE-2020-7829
Published: 2020-07-30
Description: DaviewIndy 8.98.4 and earlier version contain Heap-based overflow vulnerability, triggered when the user opens a malformed specific file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35539; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35539
CVE: CVE-2020-15130
Published: 2020-07-30
Description: In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697, CWE-697
References: https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c; https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx; https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
CVE: CVE-2020-15131
Published: 2020-07-30
Description: In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.
CVSS Score: 7.5 (HIGH)
CWE: CWE-697, CWE-697
References: https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c; https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h; https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c
CVE: CVE-2020-16157
Published: 2020-07-30
Description: A Stored XSS vulnerability exists in Nagios Log Server before 2.1.7 via the Notification Methods -> Email Users menu.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158992/Nagios-Log-Server-2.1.6-Cross-Site-Scripting.html; https://www.getastra.com/blog/911/stored-xss-vulnerability-nagios-log-server/; https://www.jinsonvarghese.com/stored-xss-vulnerability-in-nagios-log-server/