deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12062
Published: 2020-06-01
Description: The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1; https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894; https://www.openssh.com/txt/release-8.3
CVE: CVE-2020-13448
Published: 2020-06-01
Description: QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/157898/QuickBox-Pro-2.1.8-Remote-Code-Execution.html; https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/; http://packetstormsecurity.com/files/157898/QuickBox-Pro-2.1.8-Remote-Code-Execution.html
CVE: CVE-2020-13694
Published: 2020-06-01
Description: In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password, which means that the www-data user can execute arbitrary OS commands via the mysql -e option.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/; https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/
CVE: CVE-2014-7173
Published: 2020-06-01
Description: FarLinX X25 Gateway through 2014-09-25 allows command injection via shell metacharacters to sysSaveMonitorData.php, fsx25MonProxy.php, syseditdate.php, iframeupload.php, or sysRestoreX25Cplt.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.justanotherhacker.com/2016/09/jahx164_-_farlinx_x25_gateway_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2016/09/jahx164_-_farlinx_x25_gateway_multiple_vulnerabilities.html
CVE: CVE-2014-7174
Published: 2020-06-01
Description: FarLinX X25 Gateway through 2014-09-25 allows directory traversal via the log-handling feature.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.justanotherhacker.com/2016/09/jahx164_-_farlinx_x25_gateway_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2016/09/jahx164_-_farlinx_x25_gateway_multiple_vulnerabilities.html
CVE: CVE-2014-7175
Published: 2020-06-01
Description: FarLinX X25 Gateway through 2014-09-25 allows attackers to write arbitrary data to fsUI.xyz via fsSaveUIPersistence.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.justanotherhacker.com/2016/09/jahx164_-_farlinx_x25_gateway_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2016/09/jahx164_-_farlinx_x25_gateway_multiple_vulnerabilities.html
CVE: CVE-2014-8937
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows denial of service because api/update.php launches svn update operations that use a great deal of resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8938
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8939
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (full path) via an include/smarty/plugins/modifier.date_format.php request if PHP has a non-recommended configuration that produces warning messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8940
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows remote attackers to obtain sensitive information (names and details of projects) by visiting the /update.log URI.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8941
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&from_id= or admin.php?page=history&limit= URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8942
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8943
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svn_url parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8944
Published: 2020-06-01
Description: Lexiglot through 2014-11-20 allows XSS (Reflected) via the username, or XSS (Stored) via the admin.php?page=config install_name, intro_message, or new_file_content parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-8945
Published: 2020-06-01
Description: admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html; https://www.justanotherhacker.com/2018/05/jahx181_-_piwigo_lexiglot_multiple_vulnerabilities.html
CVE: CVE-2014-9702
Published: 2020-06-01
Description: system/classes/DbPDO.php in Cmfive through 2015-03-15, when database connectivity malfunctions, allows remote attackers to obtain sensitive information (username and password) via any request, such as a password reset request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-522
References: https://www.justanotherhacker.com/2016/09/jahx161_-_cmfive_database_credential_disclosure.html; https://www.justanotherhacker.com/2016/09/jahx161_-_cmfive_database_credential_disclosure.html
CVE: CVE-2020-13695
Published: 2020-06-01
Description: In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/*.db or /etc/shadow file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269, CWE-306
References: https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/; https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce/
CVE: CVE-2019-15709
Published: 2020-06-01
Description: An improper input validation in FortiAP-S/W2 6.2.0 to 6.2.2, 6.0.5 and below, FortiAP-U 6.0.1 and below CLI admin console may allow unauthorized administrators to overwrite system files via specially crafted tcpdump commands in the CLI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://fortiguard.com/psirt/FG-IR-19-298; https://fortiguard.com/psirt/FG-IR-19-298
CVE: CVE-2020-13757
Published: 2020-06-01
Description: Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext. This could conceivably have a security-relevant impact, e.g., by helping an attacker to infer that an application uses Python-RSA, or if the length of accepted ciphertext affects application behavior (such as by causing excessive memory allocation).
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://github.com/sybrenstuvel/python-rsa/issues/146; https://github.com/sybrenstuvel/python-rsa/issues/146#issuecomment-641845667; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KILTHBHNSDUCYV22ODLOKTICJJ7JQIQ/
CVE: CVE-2020-13758
Published: 2020-06-01
Description: modules/security/classes/general.post_filter.php/post_filter.php in the Web Application Firewall in Bitrix24 through 20.0.950 allows XSS by placing %00 before the payload.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.deteact.com/bitrix-waf-bypass/; https://blog.deteact.com/bitrix-waf-bypass/
CVE: CVE-2020-9291
Published: 2020-06-01
Description: An Insecure Temporary File vulnerability in FortiClient for Windows 6.2.1 and below may allow a local user to gain elevated privileges via exhausting the pool of temporary file names combined with a symbolic link attack.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-668
References: https://fortiguard.com/psirt/FG-IR-20-040; https://www.fortiguard.com/psirt/FG-IR-20-040; https://fortiguard.com/psirt/FG-IR-20-040
CVE: CVE-2020-10136
Published: 2020-06-02
Description: IP-in-IP protocol specifies IP Encapsulation within IP standard (RFC 2003, STD 1) that decapsulate and route IP-in-IP traffic is vulnerable to spoofing, access-control bypass and other unexpected behavior due to the lack of validation to verify network packets before decapsulation and routing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-290, CWE-290
References: https://datatracker.ietf.org/doc/html/rfc6169; https://kb.cert.org/vuls/id/636397/; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ipip-dos-kCT9X4
CVE: CVE-2020-10703
Published: 2020-06-02
Description: A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in libvirt 6.0.0, for fetching a storage pool based on its target path. In more detail, this flaw affects storage pools created without a target path such as network-based pools like gluster and RBD. Unprivileged users with a read-only connection could abuse this flaw to crash the libvirt daemon, resulting in a potential denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=1790725; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10703; https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=5d5c732d748d644ec14626bce448e84bdc4bd93e
CVE: CVE-2020-10739
Published: 2020-06-02
Description: Istio 1.4.x before 1.4.9 and Istio 1.5.x before 1.5.4 contain the following vulnerability when telemetry v2 is enabled: by sending a specially crafted packet, an attacker could trigger a Null Pointer Exception resulting in a Denial of Service. This could be sent to the ingress gateway or a sidecar, triggering a null pointer exception which results in a denial of service. This also affects servicemesh-proxy where a null pointer exception flaw was found in servicemesh-proxy. When running Telemetry v2 (not on by default in version 1.4.x), an attacker could send a specially crafted packet to the ingress gateway or proxy sidecar, triggering a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10739; https://github.com/istio/envoy/commit/8788a3cf255b647fd14e6b5e2585abaaedb28153#diff-fcf2cf5dd389b5285f882ba4a8708633; https://istio.io/news/security/istio-security-2020-005/
CVE: CVE-2020-13659
Published: 2020-06-02
Description: address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
CVSS Score: 2.5 (LOW)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00086.html; http://www.openwall.com/lists/oss-security/2020/06/01/3; https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
CVE: CVE-2020-10959
Published: 2020-06-02
Description: resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://gerrit.wikimedia.org/r/c/mediawiki/core/+/536725; https://phabricator.wikimedia.org/T232932; https://phabricator.wikimedia.org/T240393
CVE: CVE-2020-13227
Published: 2020-06-02
Description: An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by triggering an invalid path permission error. This bypasses the fakepath protection mechanism.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/wrongsid3; https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.md; https://pasteboard.co/J9eF12G.png
CVE: CVE-2020-13228
Published: 2020-06-02
Description: An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158062/Sysax-MultiServer-6.90-Cross-Site-Scripting.html; https://github.com/wrongsid3; https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.md
CVE: CVE-2020-13229
Published: 2020-06-02
Description: An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is an authentication token.
CVSS Score: 8.8 (HIGH)
CWE: CWE-384
References: https://github.com/wrongsid3; https://github.com/wrongsid3/Sysax-MultiServer-6.90-Multiple-Vulnerabilities/blob/master/README.md; https://github.com/wrongsid3
CVE: CVE-2020-13401
Published: 2020-06-02
Description: An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00040.html; http://www.openwall.com/lists/oss-security/2020/06/01/5; https://docs.docker.com/engine/release-notes/
CVE: CVE-2020-13754
Published: 2020-06-02
Description: hw/pci/msix.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access via a crafted address in an msi-x mmio operation.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: http://www.openwall.com/lists/oss-security/2020/06/01/6; http://www.openwall.com/lists/oss-security/2020/06/15/8; https://lists.debian.org/debian-lts-announce/2020/07/msg00020.html
CVE: CVE-2020-4360
Published: 2020-06-02
Description: IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178765.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178765; https://www.ibm.com/support/pages/node/6214472; https://exchange.xforce.ibmcloud.com/vulnerabilities/178765
CVE: CVE-2020-4366
Published: 2020-06-02
Description: IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178965.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178965; https://www.ibm.com/support/pages/node/6214472; https://exchange.xforce.ibmcloud.com/vulnerabilities/178965
CVE: CVE-2020-4367
Published: 2020-06-02
Description: IBM Planning Analytics Local 2.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179001.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/179001; https://www.ibm.com/support/pages/node/6214472; https://exchange.xforce.ibmcloud.com/vulnerabilities/179001
CVE: CVE-2020-4431
Published: 2020-06-02
Description: IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180761.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/180761; https://www.ibm.com/support/pages/node/6214472; https://exchange.xforce.ibmcloud.com/vulnerabilities/180761
CVE: CVE-2020-4503
Published: 2020-06-02
Description: IBM Planning Analytics Local 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 182283.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182283; https://www.ibm.com/support/pages/node/6214472; https://exchange.xforce.ibmcloud.com/vulnerabilities/182283
CVE: CVE-2019-14038
Published: 2020-06-02
Description: Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, QCS605, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM670, SDM710, SDM845, SDX20, SDX24
CVSS Score: 7.1 (HIGH)
CWE: CWE-20, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14039
Published: 2020-06-02
Description: Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, QCS605, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM670, SDM710, SDM845, SDX20, SDX24
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14042
Published: 2020-06-02
Description: Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Kamorta, MDM9205, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14043
Published: 2020-06-02
Description: Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Kamorta, MDM9150, MDM9205, MDM9650, MSM8998, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDA660, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14053
Published: 2020-06-02
Description: When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to a value that does not resolve to a valid XFRM mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, QCA4531, QCN7605, QCS605, QM215, SA415M, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14054
Published: 2020-06-02
Description: Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, MSM8998, QCS404, QCS605, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM8150, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14066
Published: 2020-06-02
Description: Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbers or checking Feature ID status in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Kamorta, MDM9205, MDM9607, Nicobar, QCS404, QCS405, Rennell, SA6155P, SC7180, SC8180X, SDX55, SM6150, SM7150, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin