deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-5764
Published: 2020-07-08
Description: MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILE_LIST" with a "name" field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone, but being saved outside of the intended "/sdcard/MXshare" directory. In some instances, an attacker can achieve remote code execution by writing ".odex" and ".vdex" files in the "oat" directory of the MX Player application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://www.tenable.com/security/research/tra-2020-41; https://www.tenable.com/security/research/tra-2020-41
CVE: CVE-2020-7140
Published: 2020-07-08
Description: A security vulnerability in HPE IceWall SSO Dfw and Dgfw (Domain Gateway Option) could be exploited remotely to cause a remote cross-site scripting (XSS). HPE has provided the following information to resolve this vulnerability in HPE IceWall SSO DFW and Dgfw: https://www.hpe.com/jp/icewall_patchaccess
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu04011en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu04011en_us
CVE: CVE-2020-14476
Published: 2020-07-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none
CVE: CVE-2020-11994
Published: 2020-07-08
Description: Server-Side Template Injection and arbitrary file disclosure on Camel templating components
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://lists.apache.org/thread.html/d0e00f2e147a9e9b13a[PII_REDACTED]f349b2882bf[PII_REDACTED]a52600%40%3Cannounce.tomcat.apache.org%3E; https://www.oracle.com/security-alerts/cpuApr2021.html; https://www.oracle.com/security-alerts/cpujan2021.html
CVE: CVE-2020-5839
Published: 2020-07-08
Description: Symantec Endpoint Detection And Response, prior to 4.4, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data.
CVSS Score: 7.5 (HIGH)
References: https://support.broadcom.com/security-advisory/content/security-advisories/SEDR-Information-Disclosure/SYMSA16090; https://support.broadcom.com/security-advisory/content/security-advisories/SEDR-Information-Disclosure/SYMSA16090
CVE: CVE-2020-6938
Published: 2020-07-08
Description: A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: https://help.salesforce.com/apex/HTViewSolution?urlname=Sensitive-information-disclosure-vulnerability-affecting-Tableau-Server-in-certain-use-cases&language=en_US; https://help.salesforce.com/articleView?id=000354158&type=1&mode=1; https://help.salesforce.com/apex/HTViewSolution?urlname=Sensitive-information-disclosure-vulnerability-affecting-Tableau-Server-in-certain-use-cases&language=en_US
CVE: CVE-2019-19415
Published: 2020-07-08
Description: The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the affected device. Due to the insufficient verification of the packets, successful exploit could allow the attacker to cause buffer overflow and dead loop, leading to DoS condition. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en
CVE: CVE-2019-19416
Published: 2020-07-08
Description: The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the affected device. Due to the insufficient verification of the packets, successful exploit could allow the attacker to cause buffer overflow and dead loop, leading to DoS condition. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en
CVE: CVE-2019-19417
Published: 2020-07-08
Description: The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the affected device. Due to the insufficient verification of the packets, successful exploit could allow the attacker to cause buffer overflow and dead loop, leading to DoS condition. Affected products can be found in https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-sip-en
CVE: CVE-2020-1982
Published: 2020-07-08
Description: Certain communication between PAN-OS and cloud-delivered services inadvertently use TLS 1.0, which is known to be a cryptographically weak protocol. These cloud services include Cortex Data Lake, the Customer Support Portal, and the Prisma Access infrastructure. Conditions required for exploitation of known TLS 1.0 weaknesses do not exist for the communication between PAN-OS and cloud-delivered services. We do not believe that any communication is impacted as a result of known attacks against TLS 1.0. This issue impacts: All versions of PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.14; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. PAN-OS 7.1 is not impacted by this issue.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-326, CWE-326
References: https://security.paloaltonetworks.com/CVE-2020-1982; https://security.paloaltonetworks.com/CVE-2020-1982
CVE: CVE-2020-2030
Published: 2020-07-08
Description: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; and all versions of PAN-OS 7.1 and PAN-OS 8.0. This issue does not impact PAN-OS 9.0, PAN-OS 9.1, or Prisma Access services.
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/CVE-2020-2030; https://security.paloaltonetworks.com/CVE-2020-2030
CVE: CVE-2020-2031
Published: 2020-07-08
Description: An integer underflow vulnerability in the dnsproxyd component of the PAN-OS management interface allows authenticated administrators to issue a command from the command line interface that causes the component to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 9.1 versions earlier than PAN-OS 9.1.3. This issue does not impact PAN-OS 8.1, PAN-OS 9.0, or Prisma Access services.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-191, CWE-191
References: https://security.paloaltonetworks.com/CVE-2020-2031; https://security.paloaltonetworks.com/CVE-2020-2031
CVE: CVE-2020-2034
Published: 2020-07-08
Description: An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/CVE-2020-2034; https://security.paloaltonetworks.com/CVE-2020-2034
CVE: CVE-2020-15072
Published: 2020-07-08
Description: An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html; https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377; https://www.phplist.org/newslist/phplist-3-5-5-release-notes/
CVE: CVE-2020-15073
Published: 2020-07-08
Description: An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html; https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377; https://www.phplist.org/newslist/phplist-3-5-5-release-notes/
CVE: CVE-2020-5974
Published: 2020-07-08
Description: NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories, which can lead to escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5039; https://nvidia.custhelp.com/app/answers/detail/a_id/5039
CVE: CVE-2020-5604
Published: 2020-07-09
Description: Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView.
CVSS Score: 8.1 (HIGH)
References: https://jvn.jp/en/jp/JVN93167107/index.html; https://jvn.jp/en/jp/JVN93167107/index.html
CVE: CVE-2020-9376
Published: 2020-07-09
Description: D-Link DIR-610 devices allow Information Disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZED_GROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.5 (HIGH)
CWE: CWE-74
References: https://gist.github.com/GouveaHeitor/dcbb67b301cc45adc00f8a6a2a0a590f; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182; https://www.dlink.com.br/produto/dir-610/
CVE: CVE-2020-9377
Published: 2020-07-09
Description: D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://gist.github.com/GouveaHeitor/131557f9de7d571f118f59805df852dc; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10182; https://www.dlink.com.br/produto/dir-610/
CVE: CVE-2018-12371
Published: 2020-07-09
Description: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1465686; https://www.mozilla.org/security/advisories/mfsa2018-15/; https://www.mozilla.org/security/advisories/mfsa2018-16/
CVE: CVE-2019-10096
Published: 2020-07-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-11992
Published: 2020-07-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-12424
Published: 2020-07-09
Description: When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1562600
CVE: CVE-2020-5366
Published: 2020-07-09
Description: Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files.
CVSS Score: 7.1 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.dell.com/support/article/en-us/sln322125/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en; https://www.dell.com/support/article/en-us/sln322125/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en
CVE: CVE-2020-7457
Published: 2020-07-09
Description: In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed, possibly resulting in code execution.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-416, CWE-662
References: http://packetstormsecurity.com/files/158695/FreeBSD-ip6_setpktopt-Use-After-Free-Privilege-Escalation.html; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:20.ipv6.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2020-7458
Published: 2020-07-09
Description: In FreeBSD 12.1-STABLE before r362281, 11.4-STABLE before r362281, and 11.4-RELEASE before p1, long values in the user-controlled PATH environment variable cause posix_spawnp to write beyond the end of the heap allocated stack possibly leading to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:18.posix_spawnp.asc; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.FreeBSD.org/advisories/FreeBSD-SA-20:18.posix_spawnp.asc
CVE: CVE-2020-7692
Published: 2020-07-09
Description: PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
CVSS Score: 7.4 (HIGH)
CWE: CWE-863
References: https://github.com/googleapis/google-oauth-java-client/commit/13433cd7dd06267fc261f0b1d4764f8e3432c824; https://github.com/googleapis/google-oauth-java-client/issues/469; https://lists.apache.org/thread.html/r3db6ac73e0558d64f0b664f2fa4ef0a865e57c5de20f8321d3b48678%40%3Ccommits.druid.apache.org%3E
CVE: CVE-2020-7693
Published: 2020-07-09
Description: Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://github.com/andsnw/sockjs-dos-py; https://github.com/sockjs/sockjs-node/commit/dd7e642cd69ee[PII_REDACTED]6d30642c43e051d16; https://github.com/sockjs/sockjs-node/issues/252
CVE: CVE-2020-12398
Published: 2020-07-09
Description: If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. This vulnerability affects Thunderbird < 68.9.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1613623; https://usn.ubuntu.com/4421-1/; https://www.mozilla.org/security/advisories/mfsa2020-22/
CVE: CVE-2020-12399
Published: 2020-07-09
Description: NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-203
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1631576; https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html; https://security.gentoo.org/glsa/202007-49
CVE: CVE-2020-12402
Published: 2020-07-09
Description: During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00016.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00018.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html
CVE: CVE-2020-12404
Published: 2020-07-09
Description: For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1631739; https://www.mozilla.org/security/advisories/mfsa2020-19/; https://bugzilla.mozilla.org/show_bug.cgi?id=1631739
CVE: CVE-2020-12405
Published: 2020-07-09
Description: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1631618; https://usn.ubuntu.com/4421-1/; https://www.mozilla.org/security/advisories/mfsa2020-20/
CVE: CVE-2020-12406
Published: 2020-07-09
Description: Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-345
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1639590; https://usn.ubuntu.com/4421-1/; https://www.mozilla.org/security/advisories/mfsa2020-20/
CVE: CVE-2020-12407
Published: 2020-07-09
Description: Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary GPU memory to the visible screen. The leaked memory content was visible to the user, but not observable from web content. This vulnerability affects Firefox < 77.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1637112; https://www.mozilla.org/security/advisories/mfsa2020-20/; https://bugzilla.mozilla.org/show_bug.cgi?id=1637112
CVE: CVE-2020-12408
Published: 2020-07-09
Description: When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path information in the address bar. This vulnerability affects Firefox < 77.
CVSS Score: 6.5 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1623888; https://www.mozilla.org/security/advisories/mfsa2020-20/; https://bugzilla.mozilla.org/show_bug.cgi?id=1623888
CVE: CVE-2020-12409
Published: 2020-07-09
Description: When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This vulnerability affects Firefox < 77.
CVSS Score: 8.8 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1629506; https://www.mozilla.org/security/advisories/mfsa2020-20/; https://bugzilla.mozilla.org/show_bug.cgi?id=1629506
CVE: CVE-2020-12410
Published: 2020-07-09
Description: Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1619305%2C1632717; https://usn.ubuntu.com/4421-1/; https://www.mozilla.org/security/advisories/mfsa2020-20/
CVE: CVE-2020-12411
Published: 2020-07-09
Description: Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 77.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1620972%2C1625333; https://www.mozilla.org/security/advisories/mfsa2020-20/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1620972%2C1625333
CVE: CVE-2020-12412
Published: 2020-07-09
Description: By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme, a blocked port number such as '1', and without a lock icon) while controlling the page contents. This vulnerability affects Firefox < 70.
CVSS Score: 4.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1528587; https://www.mozilla.org/security/advisories/mfsa2019-34/; https://bugzilla.mozilla.org/show_bug.cgi?id=1528587
CVE: CVE-2020-12414
Published: 2020-07-09
Description: IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-459
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1646756; https://www.mozilla.org/security/advisories/mfsa2020-23/; https://bugzilla.mozilla.org/show_bug.cgi?id=1646756
CVE: CVE-2020-12415
Published: 2020-07-09
Description: When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. This vulnerability affects Firefox < 78.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1586630