deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-28142
Published: 2021-04-06
Description: CITSmart before 9.1.2.28 mishandles the "filtro de autocomplete."
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/162182/CITSmart-ITSM-9.1.2.27-SQL-Injection.html; https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html; http://packetstormsecurity.com/files/162182/CITSmart-ITSM-9.1.2.27-SQL-Injection.html
CVE: CVE-2021-28658
Published: 2021-04-06
Description: In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://docs.djangoproject.com/en/3.1/releases/security/; https://groups.google.com/g/django-announce/c/ePr5j-ngdPU; https://lists.debian.org/debian-lts-announce/2021/04/msg00008.html
CVE: CVE-2021-30130
Published: 2021-04-06
Description: phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: https://github.com/phpseclib/phpseclib/pull/1635; https://github.com/phpseclib/phpseclib/releases/tag/2.0.31; https://github.com/phpseclib/phpseclib/releases/tag/3.0.7
CVE: CVE-2020-23533
Published: 2021-04-06
Description: Union Pay up to 1.2.0, for web based versions contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: http://mobitec.ie.cuhk.edu.hk/cve_2020/; https://cwe.mitre.org/data/definitions/347.html; https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0
CVE: CVE-2020-36284
Published: 2021-04-06
Description: Union Pay up to 3.4.93.4.9, for android, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: http://mobitec.ie.cuhk.edu.hk/cve_2020/; https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0; https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0
CVE: CVE-2020-36285
Published: 2021-04-06
Description: Union Pay up to 3.3.12, for iOS mobile apps, contains a CWE-347: Improper Verification of Cryptographic Signature vulnerability, allows attackers to shop for free in merchants' websites and mobile apps, via a crafted authentication code (MAC) which is generated based on a secret key which is NULL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: http://mobitec.ie.cuhk.edu.hk/cve_2020/; https://www.dropbox.com/s/6smwnbrp0kgsgrc/poc_code.py?dl=0; https://www.dropbox.com/s/czbkdr73tclq2nr/UnionPay_Vulnerability_Report.txt?dl=0
CVE: CVE-2021-26833
Published: 2021-04-06
Description: Cleartext Storage in a File or on Disk in TimelyBills <= 1.7.0 for iOS and versions <= 1.21.115 for Android allows attacker who can locally read user's files obtain JWT tokens for user's account due to insufficient cache clearing mechanisms. A threat actor can obtain sensitive user data by decoding the tokens as JWT is signed and encoded, not encrypted.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-459
References: https://beefaaubee.medium.com/cve-2021-26833-cleartext-storage-in-a-file-or-on-disk-in-timelybills-1-7-0-5760dc461bd0; https://beefaaubee.medium.com/cve-2021-26833-cleartext-storage-in-a-file-or-on-disk-in-timelybills-1-7-0-5760dc461bd0
CVE: CVE-2021-29136
Published: 2021-04-06
Description: Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2021/04/06/2; https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57; https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v
CVE: CVE-2021-29424
Published: 2021-04-06
Description: The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVSS Score: 7.5 (HIGH)
CWE: CWE-704
References: https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBJVLXJSWN6DKSF5ADUEERI6M23R3GGP/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JF4CYIZELC3NISB3RMV4OCI4GYBC557B/
CVE: CVE-2021-30140
Published: 2021-04-06
Description: LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/167228/LiquidFiles-3.4.15-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2022/May/41; https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167
CVE: CVE-2021-30146
Published: 2021-04-06
Description: Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/Security-AVS/CVE-2021-30146; https://github.com/Security-AVS/CVE-2021-30146
CVE: CVE-2021-20334
Published: 2021-04-06
Description: A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-269, CWE-269
References: https://jira.mongodb.org/browse/COMPASS-4510; https://jira.mongodb.org/browse/COMPASS-4510
CVE: CVE-2021-24026
Published: 2021-04-06
Description: A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://www.whatsapp.com/security/advisories/2021/; https://www.whatsapp.com/security/advisories/2021/
CVE: CVE-2021-24027
Published: 2021-04-06
Description: A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.
CVSS Score: 7.5 (HIGH)
CWE: CWE-524
References: https://www.whatsapp.com/security/advisories/2021/; https://www.whatsapp.com/security/advisories/2021/
CVE: CVE-2020-36309
Published: 2021-04-06
Description: ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16; https://github.com/openresty/lua-nginx-module/pull/1654; https://news.ycombinator.com/item?id=26712562
CVE: CVE-2021-21423
Published: 2021-04-06
Description: `projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository. The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made). Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-527
References: https://github.com/projen/projen/commit/36030c6a4b1acd[PII_REDACTED]612e7c70e9446643; https://github.com/projen/projen/security/advisories/GHSA-gg2g-m5wc-vccq; https://www.npmjs.com/package/projen
CVE: CVE-2021-28688
Published: 2021-04-06
Description: The fix for XSA-365 includes initialization of pointers such that subsequent cleanup code wouldn't use uninitialized or stale values. This initialization went too far and may under certain conditions also overwrite pointers which are in need of cleaning up. The lack of cleanup would result in leaking persistent grants. The leak in turn would prevent fully cleaning up after a respective guest has died, leaving around zombie domains. All Linux versions having the fix for XSA-365 applied are vulnerable. XSA-365 was classified to affect versions back to at least 3.11.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-665
References: https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html; https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html; https://xenbits.xenproject.org/xsa/advisory-371.txt
CVE: CVE-2021-21404
Published: 2021-04-06
Description: Syncthing is a continuous file synchronization program. In Syncthing before version 1.15.0, the relay server `strelaysrv` can be caused to crash and exit by sending a relay message with a negative length field. Similarly, Syncthing itself can crash for the same reason if given a malformed message from a malicious relay server when attempting to join the relay. Relay joins are essentially random (from a subset of low latency relays) and Syncthing will by default restart when crashing, at which point it's likely to pick another non-malicious relay. This flaw is fixed in version 1.15.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/syncthing/syncthing/commit/fb4fdaf4c0a79c22cad000c42ac1394e3ccb6a97; https://github.com/syncthing/syncthing/releases/tag/v1.15.0; https://github.com/syncthing/syncthing/security/advisories/GHSA-x462-89pf-6r5h
CVE: CVE-2021-25692
Published: 2021-04-06
Description: Sensitive smart card data is logged in default INFO logs by Teradici's PCoIP Connection Manager and Security Gateway prior to version 21.01.3.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-312
References: https://advisory.teradici.com/security-advisories/77/; https://advisory.teradici.com/security-advisories/77/
CVE: CVE-2020-13418
Published: 2021-04-06
Description: OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13419
Published: 2021-04-06
Description: OpenIAM before 4.2.0.3 allows Directory Traversal in the Batch task.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13420
Published: 2021-04-06
Description: OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script.
CVSS Score: 9.8 (CRITICAL)
References: https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
CVE: CVE-2020-13421
Published: 2021-04-06
Description: OpenIAM before 4.2.0.3 has Incorrect Access Control for the Create User, Modify User Permissions, and Password Reset actions.
CVSS Score: 9.8 (CRITICAL)
References: https://cwe.mitre.org/data/definitions/284.html; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://cwe.mitre.org/data/definitions/284.html
CVE: CVE-2020-13422
Published: 2021-04-06
Description: OpenIAM before 4.2.0.3 does not verify if a user has permissions to perform /webconsole/rest/api/* administrative actions.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://cwe.mitre.org/data/definitions/862.html; https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md; https://cwe.mitre.org/data/definitions/862.html
CVE: CVE-2021-22157
Published: 2021-04-06
Description: Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0002; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0002
CVE: CVE-2021-22158
Published: 2021-04-06
Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is vulnerable to XML external entity (XXE) injection in the Web Console. The vulnerability requires admin user privileges and knowledge of the XML file's encryption key to successfully exploit. All versions before 7.11 are affected.
CVSS Score: 7.2 (HIGH)
CWE: CWE-611
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0003; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0003
CVE: CVE-2021-27899
Published: 2021-04-06
Description: The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate, which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are affected. Agents for Windows and Cloud are not affected.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0004; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0004
CVE: CVE-2021-27900
Published: 2021-04-06
Description: The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) is missing an authorization check on several pages in the Web Console. This enables a view-only user to change any configuration setting and delete any registered agents. All versions before 7.11.1 are affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0005; https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2021-0005
CVE: CVE-2020-36310
Published: 2021-04-07
Description: An issue was discovered in the Linux kernel before 5.8. arch/x86/kvm/svm/svm.c allows a set_memory_region_test infinite loop for certain nested page faults, aka CID-e72436bc3a52.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-835
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e72436bc3a5206f95bb384e741154166ddb3202e; https://www.debian.org/security/2022/dsa-5095
CVE: CVE-2020-36311
Published: 2021-04-07
Description: An issue was discovered in the Linux kernel before 5.9. arch/x86/kvm/svm/sev.c allows attackers to cause a denial of service (soft lockup) by triggering destruction of a large SEV VM (which requires unregistering many encrypted regions), aka CID-7be74942f184.
CVSS Score: 5.5 (MEDIUM)
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.9; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7be74942f184fdfba34ddd19a0d995deb34d4a03; https://lists.debian.org/debian-lts-announce/2021/07/msg00015.html
CVE: CVE-2020-36312
Published: 2021-04-07
Description: An issue was discovered in the Linux kernel before 5.8.10. virt/kvm/kvm_main.c has a kvm_io_bus_unregister_dev memory leak upon a kmalloc failure, aka CID-f65886606c2d.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.10; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f65886606c2d3b562716de030706dfe1bea4ed5e; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.10
CVE: CVE-2020-36313
Published: 2021-04-07
Description: An issue was discovered in the Linux kernel before 5.7. The KVM subsystem allows out-of-range access to memslots after a deletion, aka CID-0774a964ef56. This affects arch/s390/kvm/kvm-s390.c, include/linux/kvm_host.h, and virt/kvm/kvm_main.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0774a964ef561b7170d8d1b1bfe6f88002b6d219; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2021-30178
Published: 2021-04-07
Description: An issue was discovered in the Linux kernel through 5.11.11. synic_get in arch/x86/kvm/hyperv.c has a NULL pointer dereference for certain accesses to the SynIC Hyper-V context, aka CID-919f4ebc5987.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=919f4ebc598701670e80e31573a58f1f2d2bf918; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ5GEETMX3ERQ4DF3GSS2XPNSOOK44OB/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGQDVYCDM3F5VXUZIADIV2ERL3AJXNJS/
CVE: CVE-2021-30147
Published: 2021-04-07
Description: DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://dmasoftlab.com/; http://packetstormsecurity.com/files/162136/DMA-Radius-Manager-4.4.0-Cross-Site-Request-Forgery.html; https://github.com/1d8/publications/tree/main/cve-2021-30147
CVE: CVE-2020-11191
Published: 2021-04-07
Description: Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.2 (HIGH)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11210
Published: 2021-04-07
Description: Possible memory corruption in RPM region due to improper XPU configuration in Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11231
Published: 2021-04-07
Description: Two threads call one or both functions concurrently leading to corruption of pointers and reference counters which in turn can lead to heap corruption in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11234
Published: 2021-04-07
Description: When sending a socket event message to a user application, invalid information will be passed if socket is freed by other thread resulting in a Use After Free condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
CVSS Score: 8.4 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11236
Published: 2021-04-07
Description: Memory corruption due to invalid value of total dimension in the non-histogram type KPI could lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11237
Published: 2021-04-07
Description: Memory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11242
Published: 2021-04-07
Description: User could gain access to secure memory due to incorrect argument into address range validation api used in SDI to capture requested contents in Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11243
Published: 2021-04-07
Description: RRC sends a connection establishment success to NAS even though connection setup validation returns failure and leads to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11245
Published: 2021-04-07
Description: Unintended reads and writes by NS EL2 in access control driver due to lack of check of input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
CVSS Score: 8.4 (HIGH)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin
CVE: CVE-2020-11246
Published: 2021-04-07
Description: A double free condition can occur when the device moves to suspend mode during secure playback in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
CVSS Score: 8.4 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin; https://www.qualcomm.com/company/product-security/bulletins/april-2021-bulletin