deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2000-1249
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2000-1250
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2000-1251
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2000-1252
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2001-1588
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2001-1589
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2001-1590
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2001-1591
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2001-1592
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2002-2440
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2002-2441
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2002-2442
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2003-1600
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2003-1601
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2003-1602
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2004-2772
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2004-2773
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2004-2774
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2004-2775
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2005-4892
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2005-4893
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2005-4894
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2006-7251
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2007-6747
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2007-6748
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2007-6749
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2008-7304
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2008-7305
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2008-7306
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2008-7307
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2008-7308
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2009-5069
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2009-5070
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2009-5104
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2009-5105
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2009-5106
Published: 2020-11-05
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-24426
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1354/; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24427
Published: 2020-11-05
Description: Acrobat Reader versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by an input validation vulnerability when decoding a crafted codec that could result in the disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24428
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) for macOS are affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.7 (HIGH)
CWE: CWE-367
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24429
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) for macOS are affected by a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.7 (HIGH)
CWE: CWE-347
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24430
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24431
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-285
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24432
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) and Adobe Acrobat Pro DC 2[PII_REDACTED]5 (and earlier) are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the current user. To exploit this issue, an attacker must acquire and then modify a certified PDF document that is trusted by the victim. The attacker then needs to convince the victim to open the document.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24433
Published: 2020-11-05
Description: Adobe Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary code as SYSTEM. Exploitation of this issue requires an attacker to socially engineer a victim, or the attacker must already have some access to the environment.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24434
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1356/; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24435
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file in Acrobat Reader.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1157; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24436
Published: 2020-11-05
Description: Acrobat Pro DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit in that the victim must open a malicious document.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1355/; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24437
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1156; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24438
Published: 2020-11-05
Description: Acrobat Reader DC versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 3.3 (LOW)
CWE: CWE-416, CWE-416
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://www.zerodayinitiative.com/advisories/ZDI-20-1357/; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-24439
Published: 2020-11-05
Description: Acrobat Reader DC for macOS versions 2[PII_REDACTED]8 (and earlier), 2[PII_REDACTED]5 (and earlier) and 2[PII_REDACTED]5 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process.
CVSS Score: 2.8 (LOW)
CWE: CWE-347
References: https://helpx.adobe.com/security/products/acrobat/apsb20-67.html; https://helpx.adobe.com/security/products/acrobat/apsb20-67.html
CVE: CVE-2020-5793
Published: 2020-11-05
Description: A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
References: https://www.tenable.com/security/tns-2020-07; https://www.tenable.com/security/tns-2020-08; https://www.tenable.com/security/tns-2020-07
CVE: CVE-2020-5939
Published: 2020-11-05
Description: In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.3, 15.0.0-15.0.1.3, 14.1.0-14.1.2.6, and 13.1.0-13.1.3.4, BIG-IP Virtual Edition (VE) systems on VMware, with an Intel-based 85299 Network Interface Controller (NIC) card and Single Root I/O Virtualization (SR-IOV) enabled on vSphere, may fail and leave the Traffic Management Microkernel (TMM) in a state where it cannot transmit traffic.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K75111593; https://support.f5.com/csp/article/K75111593
CVE: CVE-2020-5940
Published: 2020-11-05
Description: In versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.3, a stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface (TMUI), also known as the BIG-IP Configuration utility.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.f5.com/csp/article/K43310520; https://support.f5.com/csp/article/K43310520
CVE: CVE-2020-5941
Published: 2020-11-05
Description: On BIG-IP versions 16.0.0-16.0.0.1 and 15.1.0-15.1.0.5, using the RESOLV::lookup command within an iRule may cause the Traffic Management Microkernel (TMM) to generate a core file and restart. This issue occurs when data exceeding the maximum limit of a hostname passes to the RESOLV::lookup command.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K03125360; https://support.f5.com/csp/article/K03125360
CVE: CVE-2020-5942
Published: 2020-11-05
Description: In BIG-IP PEM versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.2.7, 13.1.0-13.1.3.4, 12.1.0-12.1.5.2, and 11.6.1-11.6.5.2, when processing Capabilities-Exchange-Answer (CEA) packets with certain attributes from the Policy and Charging Rules Function (PCRF) server, the Traffic Management Microkernel (TMM) may generate a core file and restart.
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K82530456; https://support.f5.com/csp/article/K82530456
CVE: CVE-2020-5943
Published: 2020-11-05
Description: In versions 14.1.0-14.1.0.1 and 14.1.2.5-14.1.2.7, when a BIG-IP object is created or listed through the REST interface, the protected fields are obfuscated in the REST response, not protected via a SecureVault cryptogram as TMSH does. One example of protected fields is the GTM monitor password.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-327
References: https://support.f5.com/csp/article/K20059815; https://support.f5.com/csp/article/K20059815
CVE: CVE-2020-5944
Published: 2020-11-05
Description: In BIG-IQ 7.1.0, accessing the DoS Summary events and DNS Overview pages in the BIG-IQ system interface returns an error message due to disabled Grafana reverse proxy in web service configuration. F5 has done further review of this vulnerability and has re-classified it as a defect. CVE-2020-5944 will continue to be referenced in F5 Security Advisory K57274211 and will not be assigned to other F5 vulnerabilities.
CVSS Score: 4.3 (MEDIUM)
References: https://support.f5.com/csp/article/K57274211; https://support.f5.com/csp/article/K57274211
CVE: CVE-2020-5945
Published: 2020-11-05
Description: In BIG-IP versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, undisclosed TMUI page contains a stored cross site scripting vulnerability (XSS). The issue allows a minor privilege escalation for resource admin to escalate to full admin.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://support.f5.com/csp/article/K21540525; https://support.f5.com/csp/article/K21540525
CVE: CVE-2020-5946
Published: 2020-11-05
Description: In BIG-IP Advanced WAF and FPS versions 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, and 14.1.0-14.1.2.7, under some circumstances, certain format client-side alerts sent to the BIG-IP virtual server configured with DataSafe may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).
CVSS Score: 7.5 (HIGH)
References: https://support.f5.com/csp/article/K53821711; https://support.f5.com/csp/article/K53821711
CVE: CVE-2020-6015
Published: 2020-11-05
Description: Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of service log files in non-standard locations.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://supportcontent.checkpoint.com/solutions?id=sk170117; https://supportcontent.checkpoint.com/solutions?id=sk170117
CVE: CVE-2020-13536
Published: 2020-11-05
Description: An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary. By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1148; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1148
CVE: CVE-2020-13537
Published: 2020-11-05
Description: An exploitable local privilege elevation vulnerability exists in the file system permissions of Moxa MXView series 3.1.8 installation. Depending on the vector chosen, an attacker can either add code to a script or replace a binary.By default MXViewService, which starts as a NT SYSTEM authority user executes a series of Node.Js scripts to start additional application functionality and among them the mosquitto executable is also run.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1148; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1148
CVE: CVE-2020-17510
Published: 2020-11-05
Description: Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://lists.apache.org/thread.html/r575301804bfac87a064359cf4b4ae9d514f2d10db7d44120765f4129%40%3Cdev.shiro.apache.org%3E; https://lists.apache.org/thread.html/r70098e336d02047ce4d4e69293fe8d558cd68cde06f[PII_REDACTED]bc4%40%3Cdev.shiro.apache.org%3E; https://lists.apache.org/thread.html/r70b907ccb306e9391145e2b10f56cc6914a245f91720a17a486c020a%40%3Cdev.shiro.apache.org%3E
CVE: CVE-2020-25661
Published: 2020-11-05
Description: A Red Hat only CVE-2020-12351 regression issue was found in the way the Linux kernel's Bluetooth implementation handled L2CAP packets with A2MP CID. This flaw allows a remote attacker in an adjacent range to crash the system, causing a denial of service or potentially executing arbitrary code on the system by sending a specially crafted L2CAP packet. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-843, CWE-843
References: https://access.redhat.com/security/cve/CVE-2020-12351; https://access.redhat.com/security/vulnerabilities/BleedingTooth; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25661
CVE: CVE-2020-25662
Published: 2020-11-05
Description: A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the system by sending specially crafted AMP packets. The highest threat from this vulnerability is to data confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-665, CWE-665
References: https://access.redhat.com/security/cve/CVE-2020-12352; https://access.redhat.com/security/vulnerabilities/BleedingTooth; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25662