deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-14067
Published: 2020-06-02
Description: Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS404, QCS405, QCS605, QM215, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14077
Published: 2020-06-02
Description: Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, IPQ6018, Kamorta, MDM9150, MDM9205, MDM9607, MDM9650, MSM8909, MSM8998, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-704
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14078
Published: 2020-06-02
Description: Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, MSM8909, MSM8998, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845
CVSS Score: 7.8 (HIGH)
CWE: CWE-131
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-14087
Published: 2020-06-02
Description: Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, QCS605
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2019-17603
Published: 2020-06-02
Description: Ene.sys in Asus Aura Sync through 1.07.71 does not properly validate input to IOCTL 0x80102044, 0x80102050, and 0x80102054, which allows local users to cause a denial of service (system crash) or gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/158221/ASUS-Aura-Sync-1.07.71-Privilege-Escalation.html; https://zer0-day.pw/2020-06/asus-aura-sync-stack-based-buffer-overflow/; http://packetstormsecurity.com/files/158221/ASUS-Aura-Sync-1.07.71-Privilege-Escalation.html
CVE: CVE-2020-3610
Published: 2020-06-02
Description: Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this object in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, MSM8909W, MSM8917, MSM8953, MSM8996AU, Nicobar, QCS405, QCS605, QM215, Rennell, SA415M, Saipan, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3615
Published: 2020-06-02
Description: Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames due to improper enum values used to check the frame subtype in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8009, APQ8053, APQ8096AU, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS605, SC8180X, SDM630, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM8150, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3616
Published: 2020-06-02
Description: Buffer overflow in display function due to memory copy without checking length of size using strcpy function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909W, MSM8917, MSM8953, MSM8996AU, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SM6150, SM7150, SM8150
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3618
Published: 2020-06-02
Description: NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, QCA8081, SC8180X, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3623
Published: 2020-06-02
Description: kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3625
Published: 2020-06-02
Description: When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attributes in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3630
Published: 2020-06-02
Description: Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8917, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS405, QCS605, QM215, Rennell, SA415M, SA6155P, Saipan, SC8180X, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3633
Published: 2020-06-02
Description: Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, MSM8998, QCS405, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3641
Published: 2020-06-02
Description: Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996AU, MSM8998, QCA6574AU, QCM2150, QCS405, QCS605, QM215, Rennell, SA6155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3645
Published: 2020-06-02
Description: Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, Kamorta, Nicobar, QCA6390, QCA8081, QCN7605, QCS404, QCS405, QCS605, Rennell, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2020-3680
Published: 2020-06-02
Description: A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8009, APQ8053, MSM8909W, MSM8917, MSM8953, QCS605, QM215, SA415M, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM670, SDM710, SDM845, SDX24, SXR1130
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/may-2020-bulletin
CVE: CVE-2018-18623
Published: 2020-06-02
Description: Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/grafana/grafana/issues/15293; https://github.com/grafana/grafana/pull/11813; https://github.com/grafana/grafana/releases/tag/v6.0.0
CVE: CVE-2018-18624
Published: 2020-06-02
Description: Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/grafana/grafana/pull/11813; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/grafana/grafana/pull/11813
CVE: CVE-2018-18625
Published: 2020-06-02
Description: Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/grafana/grafana/pull/11813; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://github.com/grafana/grafana/pull/11813
CVE: CVE-2019-11843
Published: 2020-06-02
Description: The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/mailpoet/mailpoet/releases/tag/3.23.2; https://pluginarchive.com/wordpress/mailpoet/v/3-23-2; https://wordpress.org/plugins/mailpoet/#developers
CVE: CVE-2020-5410
Published: 2020-06-02
Description: Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-23, CWE-22
References: https://tanzu.vmware.com/security/cve-2020-5410; https://tanzu.vmware.com/security/cve-2020-5410; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5410
CVE: CVE-2020-12017
Published: 2020-06-02
Description: GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsa-20-154-05; https://www.us-cert.gov/ics/advisories/icsa-20-154-05
CVE: CVE-2020-13759
Published: 2020-06-02
Description: rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-662
References: https://github.com/rust-vmm/vm-memory/issues/93; https://github.com/rust-vmm/vm-memory/releases/tag/v0.1.1; https://github.com/rust-vmm/vm-memory/releases/tag/v0.2.1
CVE: CVE-2020-7662
Published: 2020-06-02
Description: websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
CVSS Score: 7.5 (HIGH)
References: https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions; https://github.com/faye/websocket-extensions-node/commit/29496f6838bfadfe5a2f85dff33ed0ba33873237; https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv
CVE: CVE-2020-7663
Published: 2020-06-02
Description: websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.
CVSS Score: 7.5 (HIGH)
References: https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions; https://github.com/faye/websocket-extensions-ruby/commit/aa156a439da681361ed6f53f1a[PII_REDACTED]838b; https://github.com/faye/websocket-extensions-ruby/security/advisories/GHSA-g6wq-qcwm-j5g2
CVE: CVE-2020-13760
Published: 2020-06-02
Description: In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-csrf-in-com-postinstall; https://developer.joomla.org/security-centre/[PII_REDACTED]5-core-csrf-in-com-postinstall
CVE: CVE-2020-13761
Published: 2020-06-02
Description: In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-xss-in-modules-heading-tag-option; https://developer.joomla.org/security-centre/[PII_REDACTED]1-core-xss-in-modules-heading-tag-option
CVE: CVE-2020-13762
Published: 2020-06-02
Description: In Joomla! before 3.9.19, incorrect input validation of the module tag option in com_modules allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-com-modules-tag-options; https://developer.joomla.org/security-centre/[PII_REDACTED]3-core-xss-in-com-modules-tag-options
CVE: CVE-2020-13763
Published: 2020-06-02
Description: In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-inconsistent-default-textfilter-settings; https://developer.joomla.org/security-centre/[PII_REDACTED]2-core-inconsistent-default-textfilter-settings
CVE: CVE-2020-12607
Published: 2020-06-02
Description: An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/AntonKueltz/fastecdsa/commit/4a16daeaf139be20654ef58a9fe4c79dc030458c; https://github.com/AntonKueltz/fastecdsa/commit/7b64e3efaa806b4daaf73bb5172af3581812f8de; https://github.com/AntonKueltz/fastecdsa/commit/e592f106edd5acf6dacedfab2ad16fe6c735c9d1
CVE: CVE-2020-13764
Published: 2020-06-02
Description: common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://docs.gravityforms.com/gravityforms-change-log/; https://github.com/wp-premium/gravityforms/compare/2.4.8...2.4.9; https://docs.gravityforms.com/gravityforms-change-log/
CVE: CVE-2020-13775
Published: 2020-06-02
Description: ZNC 1.8.0 up to 1.8.1-rc1 allows authenticated users to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/znc/znc/commit/2390ad111bde16a78c98ac44572090b33c3bd2d8; https://github.com/znc/znc/commit/d229761821da38d984a9e4098ad96842490dc001; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNVBE4T2DRJRQHFRMHYBTN4OSOL6DBHR/
CVE: CVE-2019-20810
Published: 2020-06-03
Description: go7007_snd_init in drivers/media/usb/go7007/snd-go7007.c in the Linux kernel before 5.6 does not call snd_card_free for a failure path, which causes a memory leak, aka CID-9453264ef586.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6
CVE: CVE-2020-4026
Published: 2020-06-03
Description: The CustomAppsRestResource list resource in Atlassian Navigator Links before version 3.3.23, from version 4.0.0 before version 4.3.7, from version 5.0.0 before 5.0.1, and from version 5.1.0 before 5.1.1 allows remote attackers to enumerate all linked applications, including those that are restricted or otherwise hidden, through an incorrect authorization check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://jira.atlassian.com/browse/CRUC-8485; https://jira.atlassian.com/browse/FE-7299; https://jira.atlassian.com/browse/CRUC-8485
CVE: CVE-2019-20811
Published: 2020-06-03
Description: An issue was discovered in the Linux kernel before 5.0.6. In rx_queue_add_kobject() and netdev_queue_add_kobject() in net/core/net-sysfs.c, a reference count is mishandled, aka CID-a3e23f719f5c.
CVSS Score: 5.5 (MEDIUM)
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.0.6; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a3e23f719f5c4a38ffb3d30c8d7632a4ed8ccd9e; https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
CVE: CVE-2019-20812
Published: 2020-06-03
Description: An issue was discovered in the Linux kernel before 5.4.7. The prb_calc_retire_blk_tmo() function in net/packet/af_packet.c can result in a denial of service (CPU consumption and soft lockup) in a certain failure case involving TPACKET_V3, aka CID-b43d1f9f7067.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-400
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00008.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.7
CVE: CVE-2020-13776
Published: 2020-06-03
Description: systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2[PII_REDACTED].
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://github.com/systemd/systemd/issues/15985; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-1963
Published: 2020-06-03
Description: Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2020/06/03/2; https://lists.apache.org/thread.html/r119024ef71c8d39f952df0950a275d[PII_REDACTED]9aff544aea0129a3%40%3Cuser.ignite.apache.org%3E; https://lists.apache.org/thread.html/r1933faf8a26c431f38a5f8dbbfab80254454e54e33a79be474b67dc4%40%3Cdev.ignite.apache.org%3E