deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-6989
Published: 2020-03-24
Description: In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, a buffer overflow in the web server allows remote attackers to cause a denial-of-service condition or execute arbitrary code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-03; https://www.us-cert.gov/ics/advisories/icsa-20-056-03
CVE: CVE-2019-20576
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with P(9.0) software. The MemorySaver Content Provider allows SQL injection. The Samsung ID is SVE-2019-14365 (August 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20590
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with O(8.x) (Qualcomm chipsets) software. There is an integer underflow in the Secure Storage Trustlet. The Samsung ID is SVE-2019-13952 (July 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20591
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the Gear VR Service Content Provider. The Samsung ID is SVE-2019-14058 (July 2019).
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20592
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. There is local SQL injection in the Story Video Editor Content Provider. The Samsung ID is SVE-2019-14062 (July 2019).
CVSS Score: 7.8 (HIGH)
CWE: CWE-89
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20593
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Gallery leaks Private Mode thumbnails. The Samsung ID is SVE-2019-14208 (July 2019).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-552
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20594
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (Exynos chipsets) software. A heap overflow exists in the bootloader. The Samsung ID is SVE-2019-14371 (July 2019).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20595
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with P(9.0) software. Quick Panel allows enabling or disabling the Bluetooth stack without authentication. The Samsung ID is SVE-2019-14545 (July 2019).
CVSS Score: 2.4 (LOW)
CWE: CWE-306
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20596
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Exynos chipsets) software. There is information disclosure in the GateKeeper Trustlet. The Samsung ID is SVE-2019-13958 (June 2019).
CVSS Score: 9.1 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20597
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 (June 2019).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-347
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20598
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with O(8.x) software. Bixby leaks the keyboard's learned words, and the clipboard contents, via the lock screen. The Samsung IDs are SVE-2018-12896, SVE-2018-12897 (May 2019).
CVSS Score: 2.4 (LOW)
CWE: CWE-306
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20599
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Voice Assistant mishandles the notification audibility of a secured app. The Samsung ID is SVE-2018-13326 (May 2019).
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20600
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with O(8.0) and P(9.0) (Exynos8890 chipsets) software. A use-after-free occurs in the MALI GPU driver. The Samsung ID is SVE-2019-13921-1 (May 2019).
CVSS Score: 7.1 (HIGH)
CWE: CWE-416
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20601
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (Exynos7570, 7580, 7870, 7880, and 8890 chipsets) software. RKP memory corruption causes an arbitrary write to protected memory. The Samsung ID is SVE-2019-13921-2 (May 2019).
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20602
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.0), and P(9.0) (Qualcomm chipsets) software. The Authnr Trustlet has a NULL pointer dereference. The Samsung ID is SVE-2019-13949 (May 2019).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20603
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.0), and P(9.0) (Qualcomm chipsets) software. The ESECOMM Trustlet has a NULL pointer dereference. The Samsung ID is SVE-2019-13950 (May 2019).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20604
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with O(8.x) software. Attackers can disable Gallery permanently. The Samsung ID is SVE-2019-14031 (May 2019).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20605
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (Exynos chipsets) software. A heap overflow occurs for baseband in the Shannon modem. The Samsung ID is SVE-2019-14071 (May 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20606
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with any (before May 2019) software. A phishing attack against OMACP can change the network and internet settings. The Samsung ID is SVE-2019-14073 (May 2019).
CVSS Score: 9.3 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20607
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (MSM8996, MSM8998, Exynos7420, Exynos7870, Exynos8890, and Exynos8895 chipsets) software. A heap overflow in the keymaster Trustlet allows attackers to write to TEE memory, and achieve arbitrary code execution. The Samsung ID is SVE-2019-14126 (May 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20608
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. An attacker can use Emergency mode to disable features. The Samsung IDs are SVE-2018-13164, SVE-2018-13165 (April 2019).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20609
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can use Smartwatch to view Secure Folder notification content. The Samsung ID is SVE-2019-13899 (April 2019).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20610
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.X) and O(8.X) (Exynos 7570, 7870, 7880, 7885, 8890, 8895, and 9810 chipsets) software. A double-fetch vulnerability in Trustlet allows arbitrary TEE code execution. The Samsung ID is SVE-2019-13910 (April 2019).
CVSS Score: 8.1 (HIGH)
CWE: CWE-367
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20611
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), Go(8.1), P(9.0), and Go(9.0) (Exynos chipsets) software. A baseband stack overflow leads to arbitrary code execution. The Samsung ID is SVE-2019-13963 (April 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20612
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Broadcom Wi-Fi, and SEC Wi-Fi chipsets) software. Wi-Fi allows a denial of service via TCP SYN packets. The Samsung ID is SVE-2018-13162 (March 2019).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20613
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is time-based SQL injection in Contacts. The Samsung ID is SVE-2018-13452 (March 2019).
CVSS Score: 8.1 (HIGH)
CWE: CWE-89
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20614
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) software. Allshare allows attackers to access sensitive information. The Samsung ID is SVE-2018-13453 (March 2019).
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20615
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Attackers can bypass Factory Reset Protection (FRP) via SVoice T&C. The Samsung ID is SVE-2018-13547 (March 2019).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20616
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. Gallery leaks a thumbnail of Private Mode content. The Samsung ID is SVE-2018-13563 (March 2019).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20617
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with P(9.0) software. Secure Folder leaks preview data of recent apps. The Samsung ID is SVE-2018-13764 (March 2019).
CVSS Score: 5.3 (MEDIUM)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20618
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with P(9.0) software. The Pin Window feature allows unauthenticated unpinning of an app. The Samsung ID is SVE-2018-13765 (March 2019).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20619
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with P(9.0) software. Secure Startup leaks keyboard suggested words. The Samsung ID is SVE-2019-13773 (March 2019).
CVSS Score: 7.5 (HIGH)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20620
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with P(9.0) software. The Settings application allows unauthenticated changes. The Samsung IDs are SVE-2019-13814, SVE-2019-13815 (March 2019).
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20621
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (Exynos chipsets) software. There is a baseband heap overflow. The Samsung ID is SVE-2018-13187 (February 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20622
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (Exynos chipsets) software. There is a baseband stack overflow. The Samsung ID is SVE-2018-13188 (February 2019).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20623
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.1), O(8.x), and P(9.0) software. Gallery has uninitialized memory disclosure. The Samsung ID is SVE-2018-13060 (February 2019).
CVSS Score: 3.3 (LOW)
CWE: CWE-908
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20624
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. S-Voice leaks keyboard learned words via the lock screen. The Samsung ID is SVE-2018-12981 (February 2019).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2019-20625
Published: 2020-03-24
Description: An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The Samsung ID is SVE-2018-13427 (February 2019).
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-10941
Published: 2020-03-24
Description: Arm Mbed TLS before 2.16.5 allows attackers to obtain sensitive information (an RSA private key) by measuring cache usage during an import.
CVSS Score: 5.9 (MEDIUM)
References: https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JPE2HFBDJF3UBT6Q4VWLKNKCVCMX25J/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WD6OSOLLAR2AVPJAMGUKWRXN6477IHHV/
CVE: CVE-2020-6985
Published: 2020-03-24
Description: In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-03; https://www.us-cert.gov/ics/advisories/icsa-20-056-03
CVE: CVE-2020-6993
Published: 2020-03-24
Description: In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, an attacker can gain access to sensitive information from the web service without authorization.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-03; https://www.us-cert.gov/ics/advisories/icsa-20-056-03
CVE: CVE-2020-6995
Published: 2020-03-24
Description: In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, the application utilizes weak password requirements, which may allow an attacker to gain unauthorized access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521, CWE-521
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-03; https://www.us-cert.gov/ics/advisories/icsa-20-056-03
CVE: CVE-2020-7005
Published: 2020-03-24
Description: In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable to a cross-site request forgery, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-05; https://www.us-cert.gov/ics/advisories/icsa-20-056-05
CVE: CVE-2019-19347
Published: 2020-03-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-6071
Published: 2020-03-24
Description: An exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the compression pointer is followed without checking for recursion, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://security.gentoo.org/glsa/202005-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-0994; https://www.debian.org/security/2020/dsa-4671
CVE: CVE-2020-6072
Published: 2020-03-24
Description: An exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing compressed labels in mDNS messages, the rr_decode function's return value is not checked, leading to a double free that could be exploited to execute arbitrary code. An attacker can send an mDNS message to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-415
References: https://security.gentoo.org/glsa/202005-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-0995; https://www.debian.org/security/2020/dsa-4671
CVE: CVE-2020-6073
Published: 2020-03-24
Description: An exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing the RDATA section in a TXT record in mDNS messages, multiple integer overflows can be triggered, leading to a denial of service. An attacker can send an mDNS message to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://security.gentoo.org/glsa/202005-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-0996; https://www.debian.org/security/2020/dsa-4671
CVE: CVE-2020-6077
Published: 2020-03-24
Description: An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages, the implementation does not properly keep track of the available data in the message, possibly leading to an out-of-bounds read that would result in a denial of service. An attacker can send an mDNS message to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://security.gentoo.org/glsa/202005-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1000; https://www.debian.org/security/2020/dsa-4671
CVE: CVE-2020-6078
Published: 2020-03-24
Description: An exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0.1.0. When parsing mDNS messages in mdns_recv, the return value of the mdns_read_header function is not checked, leading to an uninitialized variable usage that eventually results in a null pointer dereference, leading to service crash. An attacker can send a series of mDNS messages to trigger this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252
References: https://security.gentoo.org/glsa/202005-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1001; https://www.debian.org/security/2020/dsa-4671
CVE: CVE-2020-6079
Published: 2020-03-24
Description: An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through decoding of the domain name performed by rr_decode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://security.gentoo.org/glsa/202005-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002; https://www.debian.org/security/2020/dsa-4671
CVE: CVE-2020-6080
Published: 2020-03-24
Description: An exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0.1.0. When encountering errors while parsing mDNS messages, some allocated data is not freed, possibly leading to a denial-of-service condition via resource exhaustion. An attacker can send one mDNS message repeatedly to trigger this vulnerability through the function rr_read_RR [5] reads the current resource record, except for the RDATA section. This is read by the loop at in rr_read. For each RR type, a different function is called. When the RR type is 0x10, the function rr_read_TXT is called at [6].
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://security.gentoo.org/glsa/202005-10; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1002; https://www.debian.org/security/2020/dsa-4671
CVE: CVE-2020-6978
Published: 2020-03-24
Description: In Honeywell WIN-PAK 4.7.2, Web and prior versions, the affected product is vulnerable due to the usage of old jQuery libraries.
CVSS Score: 7.2 (HIGH)
CWE: CWE-477
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-05; https://www.us-cert.gov/ics/advisories/icsa-20-056-05
CVE: CVE-2020-6979
Published: 2020-03-24
Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, the affected products use a hard-coded cryptographic key, increasing the possibility that confidential data can be recovered.
CVSS Score: 7.5 (HIGH)
CWE: CWE-321, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-04; https://www.us-cert.gov/ics/advisories/icsa-20-056-04
CVE: CVE-2020-6981
Published: 2020-03-24
Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, an attacker may gain access to the system without proper authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-04; https://www.us-cert.gov/ics/advisories/icsa-20-056-04