deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-8838
Published: 2020-03-23
Description: An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent, it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an arbitrary executable via a man-in-the-middle attack.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-354
References: http://packetstormsecurity.com/files/157612/ManageEngine-Asset-Explorer-Windows-Agent-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2020/May/29; https://www.manageengine.com/products/asset-explorer/sp-readme.html
CVE: CVE-2020-9392
Published: 2020-03-23
Description: An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. Because there is no permission check on the ImportJSONTable, createFromTpl, and getJSONExportTable endpoints, unauthenticated users can retrieve pricing table information, create new tables, or import/modify a table.
CVSS Score: 7.3 (HIGH)
CWE: CWE-276
References: https://www.wordfence.com/blog/2020/02/multiple-vulnerabilities-patched-in-pricing-table-by-supsystic-plugin/; https://www.wordfence.com/blog/2020/02/multiple-vulnerabilities-patched-in-pricing-table-by-supsystic-plugin/
CVE: CVE-2020-8871
Published: 2020-03-23
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.0-47107 . An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the VGA virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-9403.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-20-292/; https://www.zerodayinitiative.com/advisories/ZDI-20-292/
CVE: CVE-2020-8872
Published: 2020-03-23
Description: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.1-47117. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI component. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the hypervisor. Was ZDI-CAN-9428.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-20-293/; https://www.zerodayinitiative.com/advisories/ZDI-20-293/
CVE: CVE-2020-8873
Published: 2020-03-23
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-10031.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-367, CWE-269
References: https://www.zerodayinitiative.com/advisories/ZDI-20-294/; https://www.zerodayinitiative.com/advisories/ZDI-20-294/
CVE: CVE-2020-8874
Published: 2020-03-23
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI component. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-10032.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://www.zerodayinitiative.com/advisories/ZDI-20-295/; https://www.zerodayinitiative.com/advisories/ZDI-20-295/
CVE: CVE-2020-8875
Published: 2020-03-23
Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the IOCTL handler. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel. Was ZDI-CAN-10028.
CVSS Score: 8.8 (HIGH)
CWE: CWE-129, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-20-296/; https://www.zerodayinitiative.com/advisories/ZDI-20-296/
CVE: CVE-2020-8876
Published: 2020-03-23
Description: This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the IOCTL handler. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-10029.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-129, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-20-297/; https://www.zerodayinitiative.com/advisories/ZDI-20-297/
CVE: CVE-2020-7474
Published: 2020-03-23
Description: A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, which could cause the execution of untrusted code when using double click to open a project file which may trigger execution of a malicious DLL.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.se.com/ww/en/download/document/SEVD-2020-042-01/; https://www.se.com/ww/en/download/document/SEVD-2020-042-01/
CVE: CVE-2020-7475
Published: 2020-03-23
Description: A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-74
References: http://www.se.com/ww/en/download/document/SEVD-2020-080-01; http://www.se.com/ww/en/download/document/SEVD-2020-080-01
CVE: CVE-2019-6560
Published: 2020-03-23
Description: In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-640, CWE-640
References: https://www.us-cert.gov/ics/advisories/icsa-20-051-04; https://www.us-cert.gov/ics/advisories/icsa-20-051-04
CVE: CVE-2020-10870
Published: 2020-03-23
Description: Zim through 0.72.1 creates temporary directories with predictable names. A malicious user could predict and create Zim's temporary directories and prevent other users from being able to start Zim, resulting in a denial of service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-330
References: https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/1028; https://github.com/zim-desktop-wiki/zim-desktop-wiki/issues/1028
CVE: CVE-2020-10871
Published: 2020-03-23
Description: In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways, and there is no plan to restrict the information further
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/openwrt/luci/issues/3563#issuecomment-578522860; https://github.com/openwrt/luci/issues/3653#issue-567892007; https://github.com/openwrt/luci/issues/3766
CVE: CVE-2020-5722
Published: 2020-03-23
Description: The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html; http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html; https://www.tenable.com/security/research/tra-2020-15
CVE: CVE-2020-7476
Published: 2020-03-23
Description: A CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior to 1.0.1), which could cause execution of malicious code when a malicious file is put in the search path.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426, CWE-426
References: https://www.se.com/ww/en/download/document/SEVD-2020-070-03; https://www.se.com/ww/en/download/document/SEVD-2020-070-03
CVE: CVE-2020-7477
Published: 2020-03-23
Description: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (Versions 7.0 and prior), Quantum processors with integrated Ethernet – 140CPU65xxxxx (all Versions), and Premium processors with integrated Ethernet (all Versions), which could cause a Denial of Service when sending a specially crafted command over Modbus.
CVSS Score: 7.5 (HIGH)
CWE: CWE-754, CWE-754
References: https://www.se.com/ww/en/download/document/SEVD-2020-070-02/; https://www.se.com/ww/en/download/document/SEVD-2020-070-02/
CVE: CVE-2020-7478
Published: 2020-03-23
Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.se.com/ww/en/download/document/SEVD-2020-070-01/; https://www.zerodayinitiative.com/advisories/ZDI-20-371/; https://www.se.com/ww/en/download/document/SEVD-2020-070-01/
CVE: CVE-2020-7479
Published: 2020-03-23
Description: A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS (Versions 14 and prior using the service: IGSSupdate), which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service.
CVSS Score: 7.8 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.se.com/ww/en/download/document/SEVD-2020-070-01/; https://www.zerodayinitiative.com/advisories/ZDI-20-370/; https://www.se.com/ww/en/download/document/SEVD-2020-070-01/
CVE: CVE-2020-7480
Published: 2020-03-23
Description: A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions), which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://www.se.com/ww/en/download/document/SEVD-2020-070-04/; https://www.se.com/ww/en/download/document/SEVD-2020-070-04/
CVE: CVE-2020-7481
Published: 2020-03-23
Description: A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which could enable a successful Cross-site Scripting (XSS attack) when using the products' web server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.se.com/ww/en/download/document/SEVD-2020-070-04/; https://www.se.com/ww/en/download/document/SEVD-2020-070-04/
CVE: CVE-2020-7482
Published: 2020-03-23
Description: A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists Andover Continuum (All versions), which could cause a Reflective Cross-site Scripting (XSS attack) when using the products' web server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.se.com/ww/en/download/document/SEVD-2020-070-04/; https://www.se.com/ww/en/download/document/SEVD-2020-070-04/
CVE: CVE-2019-6558
Published: 2020-03-23
Description: In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521, CWE-521
References: https://www.us-cert.gov/ics/advisories/icsa-20-051-04; https://www.us-cert.gov/ics/advisories/icsa-20-051-04
CVE: CVE-2020-10874
Published: 2020-03-23
Description: Motorola FX9500 devices allow remote attackers to read database files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.youtube.com/watch?v=Lv-STOyQCVY; https://www.youtube.com/watch?v=Lv-STOyQCVY
CVE: CVE-2020-6967
Published: 2020-03-23
Description: In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: https://www.us-cert.gov/ics/advisories/icsa-20-051-02; https://www.us-cert.gov/ics/advisories/icsa-20-051-02
CVE: CVE-2020-8859
Published: 2020-03-23
Description: This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ELOG Electronic Logbook 3.1.4-283534d. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HTTP parameters. A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition. Was ZDI-CAN-10115.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://elog.psi.ch/elogs/Forum/69114; https://www.zerodayinitiative.com/advisories/ZDI-20-252/; https://elog.psi.ch/elogs/Forum/69114
CVE: CVE-2020-8863
Published: 2020-03-23
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the router. Was ZDI-CAN-9470.
CVSS Score: 8.8 (HIGH)
CWE: CWE-303, CWE-287
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157; https://www.zerodayinitiative.com/advisories/ZDI-20-267/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157
CVE: CVE-2020-8864
Published: 2020-03-23
Description: This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.
CVSS Score: 8.8 (HIGH)
CWE: CWE-697, CWE-697
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157; https://www.zerodayinitiative.com/advisories/ZDI-20-268/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10157
CVE: CVE-2020-8865
Published: 2020-03-23
Description: This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template] parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10469.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-23, CWE-22
References: https://lists.debian.org/debian-lts-announce/2020/04/msg00009.html; https://www.zerodayinitiative.com/advisories/ZDI-20-276/; https://lists.debian.org/debian-lts-announce/2020/04/msg00009.html
CVE: CVE-2020-8866
Published: 2020-03-23
Description: This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within add.php. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10125.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-434, CWE-434
References: https://lists.debian.org/debian-lts-announce/2020/03/msg00036.html; https://lists.horde.org/archives/announce/2020/001288.html; https://www.zerodayinitiative.com/advisories/ZDI-20-275/
CVE: CVE-2020-8868
Published: 2020-03-23
Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the __service__ user account. The product contains a hard-coded password for this account. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-9553.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: https://support.quest.com/foglight/kb/315091/fms-5-9-5-hotfix-hfix-314; https://www.zerodayinitiative.com/advisories/ZDI-20-290/; https://support.quest.com/foglight/kb/315091/fms-5-9-5-hotfix-hfix-314
CVE: CVE-2019-17559
Published: 2020-03-23
Description: There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E; https://www.debian.org/security/2020/dsa-4672; https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E
CVE: CVE-2019-17565
Published: 2020-03-23
Description: There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E; https://www.debian.org/security/2020/dsa-4672; https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E
CVE: CVE-2020-10875
Published: 2020-03-23
Description: Motorola FX9500 devices allow remote attackers to conduct absolute path traversal attacks, as demonstrated by PL/SQL Server Pages files such as /include/viewtagdb.psp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.youtube.com/watch?v=Lv-STOyQCVY; https://www.youtube.com/watch?v=Lv-STOyQCVY
CVE: CVE-2020-10879
Published: 2020-03-23
Description: rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/rconfig/rconfig/commit/3385f906427d228c48b914625136bf620f4ca0a9; https://www.exploit-db.com/exploits/48241; https://github.com/rconfig/rconfig/commit/3385f906427d228c48b914625136bf620f4ca0a9
CVE: CVE-2020-1944
Published: 2020-03-23
Description: There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content length headers. Upgrade to versions 7.1.9 and 8.0.6 or later versions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-444
References: https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E; https://www.debian.org/security/2020/dsa-4672; https://lists.apache.org/thread.html/r99d18d0bc4daa05e7d0e5a63e0e22701a421b2ef5a8f4f7694c43869%40%3Cannounce.trafficserver.apache.org%3E
CVE: CVE-2020-5252
Published: 2020-03-23
Description: The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is considered to be of low severity because the attack makes use of an existing Python condition, not the Safety tool itself. This can happen if: You are running Safety in a Python environment that you don’t trust. You are running Safety from the same Python environment where you have your dependencies installed. Dependency packages are being installed arbitrarily or without proper verification. Users can mitigate this issue by doing any of the following: Perform a static analysis by installing Docker and running the Safety Docker image: $ docker run --rm -it pyupio/safety check -r requirements.txt Run Safety against a static dependencies list, such as the requirements.txt file, in a separate, clean Python environment. Run Safety from a Continuous Integration pipeline. Use PyUp.io, which runs Safety in a controlled environment and checks Python for dependencies without any need to install them. Use PyUp's Online Requirements Checker.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-807
References: https://github.com/akoumjian/python-safety-vuln; https://github.com/pyupio/safety/security/advisories/GHSA-7q25-qrjw-6fg2; https://pyup.io/posts/patched-vulnerability/
CVE: CVE-2020-10570
Published: 2020-03-24
Description: The Telegram application through 5.12 for Android, when Show Popup is enabled, might allow physically proximate attackers to bypass intended restrictions on message reading and message replying. This might be interpreted as a bypass of the passcode feature.
CVSS Score: 6.1 (MEDIUM)
References: https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-10570; https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-10570