deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-3344
Published: 2021-03-16
Description: A privilege escalation flaw was found in OpenShift builder. During build time, credentials outside the build context are automatically mounted into the container image under construction. An OpenShift user, able to execute code during build time inside this container can re-use the credentials to overwrite arbitrary container images in internal registries and/or escalate their privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This affects github.com/openshift/builder v0.0.0[PII_REDACTED]1112-7901cb396121 and before.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522, CWE-522
References: https://bugzilla.redhat.com/show_bug.cgi?id=1921450; https://bugzilla.redhat.com/show_bug.cgi?id=1921450
CVE: CVE-2017-20002
Published: 2021-03-17
Description: The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects environments such as virtual machines automatically generated with a default blank root password, allowing all local users to escalate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=877374; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914957; https://lists.debian.org/debian-lts-announce/2021/03/msg00020.html
CVE: CVE-2020-11166
Published: 2021-03-17
Description: Potential out of bound read exception when UE receives unusually large number of padding octets in the beginning of ROHC header in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11171
Published: 2021-03-17
Description: Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11186
Published: 2021-03-17
Description: Modem will enter into busy mode in an infinite loop while parsing histogram dimension due to improper validation of input received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11188
Published: 2021-03-17
Description: Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11189
Published: 2021-03-17
Description: Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11190
Published: 2021-03-17
Description: Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11192
Published: 2021-03-17
Description: Out of bound write while parsing SDP string due to missing check on null termination in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11199
Published: 2021-03-17
Description: HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11218
Published: 2021-03-17
Description: Denial of service in baseband when NW configures LTE betaOffset-RI-Index due to lack of data validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11220
Published: 2021-03-17
Description: While processing storage SCM commands there is a time of check or time of use window where a pointer used could be invalid at a specific time while executing the storage SCM call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11221
Published: 2021-03-17
Description: Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insufficient checks in the syscall handler and leads to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11222
Published: 2021-03-17
Description: Buffer over read while processing MT SMS with maximum length due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11226
Published: 2021-03-17
Description: Out of bound memory read in Data modem while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11227
Published: 2021-03-17
Description: Out of bound write while parsing RTT/TTY packet parsing due to lack of check of buffer size before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11228
Published: 2021-03-17
Description: Part of RPM region was not protected from xblSec itself due to improper policy and leads to unprivileged access in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11230
Published: 2021-03-17
Description: Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11290
Published: 2021-03-17
Description: Use after free condition in msm ioctl events due to race between the ioctl register and deregister events in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11299
Published: 2021-03-17
Description: Buffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11305
Published: 2021-03-17
Description: Integer overflow in boot due to improper length check on arguments received in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11308
Published: 2021-03-17
Description: Buffer overflow occurs when trying to convert ASCII string to Unicode string if the actual size is more than required in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2020-11309
Published: 2021-03-17
Description: Use after free in GPU driver while mapping the user memory to GPU memory due to improper check of referenced memory in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/march-2021-bulletin
CVE: CVE-2021-28650
Published: 2021-03-17
Description: autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://gitlab.gnome.org/GNOME/gnome-autoar/-/commit/8109c368c6cfdb593faaf698c2bf5da32bb1ace4; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN5TVQ7OHZEGY6AGFLAZWCVCI53RYNHQ/; https://security.gentoo.org/glsa/202105-10
CVE: CVE-2020-13924
Published: 2021-03-17
Description: In Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for directory traversal and traverse to other directories to download files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://mail-archives.apache.org/mod_mbox/ambari-user/202102.mbox/%3CCAEJYuxEQZ_aPwJdAaSxPu-Dva%3Dhc7zZUx3-pzBORbd23g%2BGH1A%40mail.gmail.com%3E; https://mail-archives.apache.org/mod_mbox/ambari-user/202102.mbox/%3CCAEJYuxEQZ_aPwJdAaSxPu-Dva%3Dhc7zZUx3-pzBORbd23g%2BGH1A%40mail.gmail.com%3E
CVE: CVE-2021-22859
Published: 2021-03-17
Description: The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and execute arbitrary commands without privilege.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/tonykuo76/807c838b75879b0d327782dfcd2c3bea; https://www.chtsecurity.com/news/c974fd28-c19b-4003-82f3[PII_REDACTED]96; https://www.twcert.org.tw/tw/cp-132-4517-51e25-1.html
CVE: CVE-2021-22860
Published: 2021-03-17
Description: EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary commends.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://gist.github.com/tonykuo76/17d497b3472a80a5e8914227e81e6fa3; https://www.chtsecurity.com/news/12929036-924b-4b89-8a0e-3e7155e19011; https://www.twcert.org.tw/tw/cp-132-4518-c813c-1.html
CVE: CVE-2020-17525
Published: 2021-03-17
Description: Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://lists.debian.org/debian-lts-announce/2021/05/msg00000.html; https://subversion.apache.org/security/CVE-2020-17525-advisory.txt; https://lists.debian.org/debian-lts-announce/2021/05/msg00000.html
CVE: CVE-2020-15281
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15282
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15285
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15286
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15287
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15288
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15289
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15290
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15291
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15295
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15296
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15298
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15728
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15736
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15737
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15738
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15740
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15741
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15743
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15745
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15746
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15747
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15748
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15749
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15750
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15751
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15752
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15753
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15754
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15755
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15756
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15757
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15758
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15759
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15760
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15761
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15762
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15763
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15764
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15765
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-15766
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-28873
Published: 2021-03-17
Description: Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-916
References: http://fluxbb.com; https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation; http://fluxbb.com
CVE: CVE-2020-8106
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2020-8111
Published: 2021-03-17
Description: Rejected reason: Unused CVE for 2020
CVE: CVE-2021-27291
Published: 2021-03-17
Description: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1333
References: https://gist.github.com/b-c-ds/b1a2cc0c68a35c57188575eb496de5ce; https://github.com/pygments/pygments/commit/2e7e8c4a7b318f[PII_REDACTED]732754e418279a14; https://lists.debian.org/debian-lts-announce/2021/03/msg00024.html
CVE: CVE-2021-27292
Published: 2021-03-17
Description: ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
CVSS Score: 7.5 (HIGH)
References: https://gist.github.com/b-c-ds/6941d80d6b4e694df4bc269493b7be76; https://github.com/faisalman/ua-parser-js/commit/809439e20e273ce0d25c1d04e111dcf6011eb566; https://github.com/pygments/pygments/commit/2e7e8c4a7b318f[PII_REDACTED]732754e418279a14
CVE: CVE-2020-14358
Published: 2021-03-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-35454
Published: 2021-03-17
Description: The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from an Android backup because of insecure application configuration.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-312
References: https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/; https://play.google.com/store/apps/details?id=com.taidii.diibear&hl=en_US&gl=US; https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/
CVE: CVE-2020-35455
Published: 2021-03-17
Description: The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to obtain user credentials from Shared Preferences and the SQLite database because of insecure data storage.
CVSS Score: 7.8 (HIGH)
CWE: CWE-312
References: https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/; https://play.google.com/store/apps/details?id=com.taidii.diibear&hl=en_US&gl=US; https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/
CVE: CVE-2020-35456
Published: 2021-03-17
Description: The Taidii Diibear Android application 2.4.0 and all its derivatives allow attackers to view private chat messages and media files via logcat because of excessive logging.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-319
References: https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/; https://play.google.com/store/apps/details?id=com.taidii.diibear&hl=en_US&gl=US; https://github.com/galapogos/Taidii-Diibear-Vulnerabilities/
CVE: CVE-2021-20200
Published: 2021-03-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.