deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-0357
Published: 2021-02-03
Description: In netdiag, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442002.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0358
Published: 2021-02-03
Description: In netdiag, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442022.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0359
Published: 2021-02-03
Description: In netdiag, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442011.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0360
Published: 2021-02-03
Description: In netdiag, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05442006.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0361
Published: 2021-02-03
Description: In kisd, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05449968.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-125
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0362
Published: 2021-02-03
Description: In aee, there is a possible memory corruption due to a stack buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05457070.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0363
Published: 2021-02-03
Description: In mobile_log_d, there is a possible command injection due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05458478.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0364
Published: 2021-02-03
Description: In mobile_log_d, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05458478; Issue ID: ALPS05458503.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2021-0365
Published: 2021-02-03
Description: In display driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05454782.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416
References: https://corp.mediatek.com/product-security-acknowledgements; https://corp.mediatek.com/product-security-acknowledgements
CVE: CVE-2020-28144
Published: 2021-02-03
Description: Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firmware Version 5.5 or lower, and EDR-810 Series Firmware Version 5.6 or lower. Crafted requests sent to the device may allow remote arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://www.moxa.com/en/support/support/security-advisory/edr-g903-g902-810-secure-router-vulnerability; https://www.moxa.com/en/support/support/security-advisory/edr-g903-g902-810-secure-router-vulnerability
CVE: CVE-2020-29163
Published: 2021-02-03
Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by SQL injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d; https://pacsone.net/download.htm; https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d
CVE: CVE-2020-29164
Published: 2021-02-03
Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by cross-site scripting (XSS).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d; https://pacsone.net/download.htm; https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d
CVE: CVE-2020-29165
Published: 2021-02-03
Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by incorrect access control, which can result in remotely gaining administrator privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d; https://pacsone.net/download.htm; https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d
CVE: CVE-2020-29166
Published: 2021-02-03
Description: PacsOne Server (PACS Server In One Box) below 7.1.1 is affected by file read/manipulation, which can result in remote information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d; https://pacsone.net/download.htm; https://gist.github.com/leommxj/0a32afeeaac960682c5b7c9ca8ed070d
CVE: CVE-2020-25208
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.4.4701, an attacker could enumerate users via the REST API without appropriate permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2020-27222
Published: 2021-02-03
Description: In Eclipse Californium version 2.3.0 to 2.6.0, the certificate based (x509 and RPK) DTLS handshakes accidentally fails, because the DTLS server side sticks to a wrong internal state. That wrong internal state is set by a previous certificate based DTLS handshake failure with TLS parameter mismatch. The DTLS server side must be restarted to recover this. This allow clients to force a DoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-372
References: https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844; https://bugs.eclipse.org/bugs/show_bug.cgi?id=570844
CVE: CVE-2020-27994
Published: 2021-02-03
Description: SolarWinds Serv-U before 15.2.2 allows Authenticated Directory Traversal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://packetstormsecurity.com/files/161399/SolarWinds-Serv-U-FTP-Server-15.2.1-Path-Traversal.html; http://seclists.org/fulldisclosure/2021/Feb/36; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm
CVE: CVE-2020-28001
Published: 2021-02-03
Description: SolarWinds Serv-U before 15.2.2 allows Authenticated Stored XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/161400/SolarWinds-Serv-U-FTP-Server-15.2.1-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2021/Feb/37; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm
CVE: CVE-2020-28653
Published: 2021-02-03
Description: Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.
CVSS Score: 9.8 (CRITICAL)
References: http://packetstormsecurity.com/files/164231/ManageEngine-OpManager-SumPDU-Java-Deserialization.html; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125203; https://www.manageengine.com/network-monitoring/help/read-me-complete.html#125233
CVE: CVE-2020-28895
Published: 2021-02-03
Description: In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.
CVSS Score: 7.3 (HIGH)
CWE: CWE-190, CWE-787
References: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-28895; https://support2.windriver.com/index.php?page=defects&on=view&id=V7LIBC-1327; https://www.oracle.com/security-alerts/cpuapr2022.html
CVE: CVE-2020-29582
Published: 2021-02-03
Description: In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E
CVE: CVE-2020-2506
Published: 2021-02-03
Description: The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges, or reading sensitive information. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-08; https://www.qnap.com/zh-tw/security-advisory/qsa-20-08; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-2506
CVE: CVE-2020-2507
Published: 2021-02-03
Description: The vulnerability have been reported to affect earlier versions of QTS. If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-78, CWE-78
References: https://www.qnap.com/zh-tw/security-advisory/qsa-20-08; https://www.qnap.com/zh-tw/security-advisory/qsa-20-08
CVE: CVE-2020-35481
Published: 2021-02-03
Description: SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection.
CVSS Score: 9.8 (CRITICAL)
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm
CVE: CVE-2020-35482
Published: 2021-02-03
Description: SolarWinds Serv-U before 15.2.2 allows authenticated reflected XSS.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm; https://documentation.solarwinds.com/en/success_center/servu/Content/Release_Notes/Servu_15-2-2_release_notes.htm
CVE: CVE-2020-35667
Published: 2021-02-03
Description: JetBrains TeamCity Plugin before 2020.2.85695 SSRF. Vulnerability that could potentially expose user credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25755
Published: 2021-02-03
Description: In JetBrains Code With Me before 2020.3, an attacker on the local network, knowing a session ID, could get access to the encrypted traffic.
CVSS Score: 2.5 (LOW)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://jay-from-future.github.io/cve/2021/04/02/code-with-me-cve.html
CVE: CVE-2021-25756
Published: 2021-02-03
Description: In JetBrains IntelliJ IDEA before 2020.2, HTTP links were used for several remote repositories instead of HTTPS.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25757
Published: 2021-02-03
Description: In JetBrains Hub before 2020.1.12629, an open redirect was possible.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25758
Published: 2021-02-03
Description: In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-502
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25759
Published: 2021-02-03
Description: In JetBrains Hub before 2020.1.12629, an authenticated user can delete 2FA settings of any other user.
CVSS Score: 6.5 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25760
Published: 2021-02-03
Description: In JetBrains Hub before 2020.1.12669, information disclosure via the public API was possible.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25761
Published: 2021-02-03
Description: In JetBrains Ktor before 1.5.0, a birthday attack on SessionStorage key was possible.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-326
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25762
Published: 2021-02-03
Description: In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25763
Published: 2021-02-03
Description: In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-327
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25765
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25766
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.4.4701, improper resource access checks were made.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25767
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.6.1767, an issue's existence could be disclosed via YouTrack command execution.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25768
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.4.4701, permissions for attachments actions were checked improperly.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25769
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.4.6808, the YouTrack administrator wasn't able to access attachments.
CVSS Score: 7.5 (HIGH)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25770
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.5.3123, server-side template injection (SSTI) was possible, which could lead to code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25771
Published: 2021-02-03
Description: In JetBrains YouTrack before 2020.6.1099, project information could be potentially disclosed.
CVSS Score: 4.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25772
Published: 2021-02-03
Description: In JetBrains TeamCity before 2020.2.2, TeamCity server DoS was possible via server integration.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25773
Published: 2021-02-03
Description: JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25774
Published: 2021-02-03
Description: In JetBrains TeamCity before 2020.2.1, a user could get access to the GitHub access token of another user.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25775
Published: 2021-02-03
Description: In JetBrains TeamCity before 2020.2.1, the server admin could create and see access tokens for any other users.
CVSS Score: 3.8 (LOW)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25776
Published: 2021-02-03
Description: In JetBrains TeamCity before 2020.2, an ECR token could be exposed in a build's parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25777
Published: 2021-02-03
Description: In JetBrains TeamCity before 2020.2.1, permissions during token removal were checked improperly.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2021-25778
Published: 2021-02-03
Description: In JetBrains TeamCity before 2020.2.1, permissions during user deletion were checked improperly.
CVSS Score: 5.3 (MEDIUM)
References: https://blog.jetbrains.com; https://blog.jetbrains.com/blog/2021/02/03/jetbrains-security-bulletin-q4-2020/; https://blog.jetbrains.com
CVE: CVE-2020-17516
Published: 2021-02-03
Description: Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement.
CVSS Score: 7.5 (HIGH)
CWE: CWE-290, CWE-290
References: http://mail-archives.apache.org/mod_mbox/cassandra-user/202102.mbox/%3c6E4340A5-D7BE-4D33-9EC5-3B505A626D8D%40apache.org%3e; https://lists.apache.org/thread.html/r81243a412a37a[PII_REDACTED]6a13856af07cc68a93d728c52807486e9%40%3Ccommits.cassandra.apache.org%3E; https://lists.apache.org/thread.html/rcb16f36cafa184dd159e94033f87d0fc274c4752d467f3a09f2ceae4%40%3Ccommits.cassandra.apache.org%3E
CVE: CVE-2020-17523
Published: 2021-02-03
Description: Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://lists.apache.org/thread.html/r5b93ddf97e2c4cda779d22fab30539bdec454cfa5baec4ad0ffae235%40%3Cgitbox.activemq.apache.org%3E; https://lists.apache.org/thread.html/r679ca97813384bdb1a4c087810ba44d9ad9c7c11583979bb7481d196%40%3Cdev.shiro.apache.org%3E; https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E
CVE: CVE-2020-25853
Published: 2021-02-03
Description: The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, _rt_md5_hmac_veneer() or _rt_hmac_sha1_veneer(), resulting in a stack buffer over-read which can be exploited for denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker does not need to know the network's PSK.
CVSS Score: 7.5 (HIGH)
CWE: CWE-126, CWE-125
References: https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/; https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE: CVE-2020-25854
Published: 2021-02-03
Description: The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function, rt_arc4_crypt_veneer() or _AES_UnWRAP_veneer(), resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/; https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/
CVE: CVE-2020-25855
Published: 2021-02-03
Description: The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for a memcpy() operation, resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client, by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/; https://www.vdoo.com/blog/realtek-rtl8195a-vulnerabilities-discovered/