deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-21058
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.0), O(8.0) (exynos7420 or Exynos 8890/8996 chipsets) software. Cache attacks can occur against the Keymaster AES-GCM implementation because T-Tables are used; the Cryptography Extension (CE) is not used. The Samsung ID is SVE-2018-12761 (September 2018).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21059
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is Clipboard content visibility in the locked state via the emergency contact picker. The Samsung ID is SVE-2018-11806 (September 2018).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21060
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is a Keyboard learned words leak in the locked state via the emergency contact picker. The Samsung IDs are SVE-2018-11989, SVE-2018-11990 (September 2018).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21061
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) software. A fake charger can execute critical functions in the locked state. The Samsung ID is SVE-2016-6341 (August 2018).
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-276
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21062
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. When biometric authentication is disabled, an attacker can view Streams content (e.g., a Gallery slideshow) of a locked Secure Folder via a connection to an external device. The Samsung ID is SVE-2018-11766 (August 2018).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21063
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.x) (Exynos chipsets) software. Keymaster has an architectural problem because tlApi in TEE is not properly protected. The Samsung ID is SVE-2018-11792 (August 2018).
CVSS Score: 9.8 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21064
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is an array overflow in a driver's input booster. The Samsung ID is SVE-2017-11816 (August 2018).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21065
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.x) software. There is an integer underflow in eCryptFS because of a missing size check. The Samsung ID is SVE-2017-11855 (August 2018).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21066
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0) (Exynos or MediaTek chipsets) software. There is a buffer overflow in a Trustlet that can cause memory corruption. The Samsung ID is SVE-2018-11599 (July 2018).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21067
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. There is an information disclosure in a Trustlet because an address is logged. The Samsung ID is SVE-2018-11600 (July 2018).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21068
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with O(8.0) software. Execution of an application in a locked Secure Folder can occur without a password via a split screen. The Samsung ID is SVE-2018-11669 (July 2018).
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21069
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) (MediaTek chipsets) software. There is information disclosure (of kernel stack memory) in a MediaTek driver. The Samsung ID is SVE-2018-11852 (July 2018).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21070
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x), O(8.0) devices (MSM8998 or SDM845 chipsets) software. An attacker can bypass Secure Boot and obtain root access because of a missing Bootloader integrity check. The Samsung ID is SVE-2018-11552 (May 2018).
CVSS Score: 8.4 (HIGH)
CWE: CWE-354
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21071
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0) software. Because of an unprotected intent, an attacker can read arbitrary files and emails, and take over an email account. The Samsung ID is SVE-2018-11633 (May 2018).
CVSS Score: 7.3 (HIGH)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21072
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.0) (Exynos chipsets) software. A kernel driver allows out-of-bounds Read/Write operations and possibly arbitrary code execution. The Samsung ID is SVE-2018-11358 (May 2018).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21073
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.0) (Galaxy S9+, Galaxy S9, Galaxy S8+, Galaxy S8, Note 8). There is access to Clipboard content in the locked state via the Edge panel. The Samsung ID is SVE-2017-10748 (May 2018).
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21074
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.x) (Exynos or Qualcomm chipsets) software. There is information disclosure from a Trustlet via the debug log. The Samsung ID is SVE-2017-10638 (April 2018).
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21075
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. The Call+ application can load classes from an unintended path, leading to Code Execution. The Samsung ID is SVE-2017-10886 (April 2018).
CVSS Score: 9.8 (CRITICAL)
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21076
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) (Exynos8890/8895 chipsets) software. There is information disclosure (a KASLR offset) in the Secure Driver via a modified trustlet. The Samsung ID is SVE-2017-10987 (April 2018).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21077
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.x) software. There is a Clipboard content disclosure in the locked state because the keyboard may be used during an emergency call. The Samsung ID is SVE-2017-11107 (April 2018).
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21078
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.0), N(7.x), and O(8.0) software. The Contacts application allows attackers to originate video calls because SS (Supplementary Service) and USSD (Unstructured Supplementary Service Data) codes are improperly secured. The Samsung ID is SVE-2018-11469 (April 2018).
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21079
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with L(5.x), M(6.0), N(7.x), and O(8.0) software. There is a kernel pointer leak in the USB gadget driver. The Samsung ID is SVE-2017-10993 (March 2018).
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21080
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) software. A physically proximate attacker wielding a magnet can activate NFC to bypass the lockscreen. The Samsung ID is SVE-2017-10897 (March 2018).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-326
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-10262
Published: 2020-04-08
Description: An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.58.10. Attackers can activate the failsafe mode during the boot process, and use the mi_console command cascaded by the SN code shown on the product to get the root shell password, and then the attacker can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro (LX06), (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’s SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
CVSS Score: 6.8 (MEDIUM)
References: https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-10262.md; https://sec.xiaomi.com; https://www.youtube.com/watch?v=Cr5DupGxmL4
CVE: CVE-2020-10263
Published: 2020-04-08
Description: An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can (i) read Wi-Fi SSID or password, (ii) read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, (iii) use Text-To-Speech tools pretend XIAOMI speakers' voice achieve social engineering attacks, (iv) eavesdrop on users and record what XIAOMI XIAOAI speaker Pro LX06 hears, (v) modify system files, (vi) use commands to send any IR code through IR emitter on XIAOMI XIAOAI Speaker Pro LX06, (vii) stop voice assistant service, (viii) enable the XIAOMI XIAOAI Speaker Pro’ SSH or TELNET service as a backdoor, (IX) tamper with the router configuration of the router in the local area networks.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-306
References: https://github.com/Jian-Xian/CVE-POC/blob/master/CVE-2020-10263.md; https://sec.xiaomi.com; https://www.youtube.com/watch?v=Cr5DupGxmL4
CVE: CVE-2020-11576
Published: 2020-04-08
Description: Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-203
References: https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1; https://github.com/argoproj/argo-cd/pull/3215; https://www.soluble.ai/blog/argo-cves-2020
CVE: CVE-2020-10814
Published: 2020-04-08
Description: A buffer overflow vulnerability in Code::Blocks 17.12 allows an attacker to execute arbitrary code via a crafted project file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-120
References: https://sourceforge.net/p/codeblocks/code/HEAD/tree/trunk/ChangeLog; https://sourceforge.net/p/codeblocks/tickets/934/; https://www.povonsec.com/codeblocks-security-vulnerability/
CVE: CVE-2020-10975
Published: 2020-04-08
Description: GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10976
Published: 2020-04-08
Description: GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10977
Published: 2020-04-08
Description: GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/160441/GitLab-File-Read-Remote-Code-Execution.html; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/
CVE: CVE-2020-10978
Published: 2020-04-08
Description: GitLab EE/CE 8.11 to 12.9 is leaking information on Issues opened in a public project and then moved to a private project through Web-UI and GraphQL API.
CVSS Score: 5.3 (MEDIUM)
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10979
Published: 2020-04-08
Description: GitLab EE/CE 11.10 to 12.9 is leaking information on restricted CI pipelines metrics to unauthorized users.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10980
Published: 2020-04-08
Description: GitLab EE/CE 8.0.rc1 to 12.9 is vulnerable to a blind SSRF in the FogBugz integration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-10981
Published: 2020-04-08
Description: GitLab EE/CE 9.0 to 12.9 allows a maintainer to modify other maintainers' pipeline trigger descriptions within the same project.
CVSS Score: 4.3 (MEDIUM)
References: https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/; https://about.gitlab.com/releases/categories/releases/; https://about.gitlab.com/releases/2020/03/26/security-release-12-dot-9-dot-1-released/
CVE: CVE-2020-1978
Published: 2020-04-08
Description: TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect Azure dashboard service account credentials. These credentials are equivalent to the credentials associated with the Contributor role in Azure. A user with the credentials will be able to manage all the Azure resources in the subscription except for granting access to other resources. These credentials do not allow login access to the VMs themselves. This issue affects VM Series Plugin versions before 1.0.9 for PAN-OS 9.0. This issue does not affect VM Series in non-HA configurations or on other cloud platforms. It does not affect hardware firewall appliances. Since becoming aware of the issue, Palo Alto Networks has safely deleted all the tech support files with the credentials. We now filter and remove these credentials from all TechSupport files sent to us. The TechSupport files uploaded to Palo Alto Networks systems were only accessible by authorized personnel with valid Palo Alto Networks credentials. We do not have any evidence of malicious access or use of these credentials.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-255, CWE-522
References: https://security.paloaltonetworks.com/CVE-2020-1978; https://security.paloaltonetworks.com/CVE-2020-1978
CVE: CVE-2020-1984
Published: 2020-04-08
Description: Secdo tries to execute a script at a hardcoded path if present, which allows a local authenticated user with 'create folders or append data' access to the root of the OS disk (C:\) to gain system privileges if the path does not already exist or is writable. This issue affects all versions of Secdo for Windows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-73, CWE-20
References: https://security.paloaltonetworks.com/CVE-2020-1984; https://security.paloaltonetworks.com/CVE-2020-1984
CVE: CVE-2020-1985
Published: 2020-04-08
Description: Incorrect Default Permissions on C:\Programdata\Secdo\Logs folder in Secdo allows local authenticated users to overwrite system files and gain escalated privileges. This issue affects all versions Secdo for Windows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://security.paloaltonetworks.com/CVE-2020-1985; https://security.paloaltonetworks.com/CVE-2020-1985
CVE: CVE-2020-1986
Published: 2020-04-08
Description: Improper input validation vulnerability in Secdo allows an authenticated local user with 'create folders or append data' access to the root of the OS disk (C:\) to cause a system crash on every login. This issue affects all versions Secdo for Windows.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://security.paloaltonetworks.com/CVE-2020-1986; https://security.paloaltonetworks.com/CVE-2020-1986
CVE: CVE-2020-1987
Published: 2020-04-08
Description: An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie information when the troubleshooting logging level is set to "Dump". This issue affects Palo Alto Networks Global Protect Agent 5.0 versions prior to 5.0.9; 5.1 versions prior to 5.1.1.
CVSS Score: 3.9 (LOW)
CWE: CWE-200, CWE-532
References: https://security.paloaltonetworks.com/CVE-2020-1987; https://security.paloaltonetworks.com/CVE-2020-1987
CVE: CVE-2020-1988
Published: 2020-04-08
Description: An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the root of the OS disk (C:\) or to Program Files directory to gain system privileges. This issue affects Palo Alto Networks GlobalProtect Agent 5.0 versions before 5.0.5; 4.1 versions before 4.1.13 on Windows;
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-428, CWE-428
References: https://security.paloaltonetworks.com/CVE-2020-1988; https://security.paloaltonetworks.com/CVE-2020-1988
CVE: CVE-2020-1989
Published: 2020-04-08
Description: An incorrect privilege assignment vulnerability when writing application-specific files in the Palo Alto Networks Global Protect Agent for Linux on ARM platform allows a local authenticated user to gain root privileges on the system. This issue affects Palo Alto Networks Global Protect Agent for Linux 5.0 versions before 5.0.8; 5.1 versions before 5.1.1.
CVSS Score: 7.0 (HIGH)
CWE: CWE-266, CWE-269
References: https://security.paloaltonetworks.com/CVE-2020-1989; https://security.paloaltonetworks.com/CVE-2020-1989
CVE: CVE-2020-1990
Published: 2020-04-08
Description: A stack-based buffer overflow vulnerability in the management server component of PAN-OS allows an authenticated user to upload a corrupted PAN-OS configuration and potentially execute code with root privileges. This issue affects Palo Alto Networks PAN-OS 8.1 versions before 8.1.13; 9.0 versions before 9.0.7. This issue does not affect PAN-OS 7.1.
CVSS Score: 7.2 (HIGH)
CWE: CWE-121, CWE-787
References: https://security.paloaltonetworks.com/CVE-2020-1990; https://security.paloaltonetworks.com/CVE-2020-1990
CVE: CVE-2020-1991
Published: 2020-04-08
Description: An insecure temporary file vulnerability in Palo Alto Networks Traps allows a local authenticated Windows user to escalate privileges or overwrite system files. This issue affects Palo Alto Networks Traps 5.0 versions before 5.0.8; 6.1 versions before 6.1.4 on Windows. This issue does not affect Cortex XDR 7.0. This issue does not affect Traps for Linux or MacOS.
CVSS Score: 7.8 (HIGH)
CWE: CWE-377, CWE-269
References: https://security.paloaltonetworks.com/CVE-2020-1991; https://security.paloaltonetworks.com/CVE-2020-1991
CVE: CVE-2020-1992
Published: 2020-04-08
Description: A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the daemon creating a denial of service condition or potentially execute code with root privileges. This issue affects Palo Alto Networks PAN-OS 9.0 versions before 9.0.7; PAN-OS 9.1 versions before 9.1.2 on PA-7000 Series devices with an LFC installed and configured. This issue requires WildFire services to be configured and enabled. This issue does not affect PAN-OS 8.1 and earlier releases. This issue does not affect any other PA Series firewalls.
CVSS Score: 8.1 (HIGH)
CWE: CWE-134, CWE-134
References: https://security.paloaltonetworks.com/CVE-2020-1992; https://security.paloaltonetworks.com/CVE-2020-1992