deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3537
Published: 2020-09-04
Description: A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that contain Universal Naming Convention (UNC) links to a targeted user and convincing the user to follow the provided link. A successful exploit could allow the attacker to cause the application to access a remote system, possibly allowing the attacker to gain access to sensitive information that the attacker could use in additional attacks.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-200, CWE-200
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-G3NSjPn7; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-G3NSjPn7
CVE: CVE-2020-3541
Published: 2020-09-04
Description: A vulnerability in the media engine component of Cisco Webex Meetings Client for Windows, Cisco Webex Meetings Desktop App for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to gain access to sensitive information. The vulnerability is due to unsafe logging of authentication requests by the affected software. An attacker could exploit this vulnerability by reading log files that are stored in the application directory. A successful exploit could allow the attacker to gain access to sensitive information, which could be used in further attacks.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-532
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-media-znjfwHD6; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-media-znjfwHD6
CVE: CVE-2020-3542
Published: 2020-09-04
Description: A vulnerability in Cisco Webex Training could allow an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. The vulnerability is due to improper validation of input to API requests that are a part of meeting join flow. An attacker could exploit this vulnerability by sending an API request to the application, which would return a URL that includes a meeting join page that is prepopulated with the meeting username and password. A successful exploit could allow the attacker to join the password-protected meeting. The attacker would be visible in the attendee list of the meeting.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-meetings-UtbwOR4Q; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-meetings-UtbwOR4Q
CVE: CVE-2020-3545
Published: 2020-09-04
Description: A vulnerability in Cisco FXOS Software could allow an authenticated, local attacker with administrative credentials to cause a buffer overflow condition. The vulnerability is due to incorrect bounds checking of values that are parsed from a specific file. An attacker could exploit this vulnerability by supplying a crafted file that, when it is processed, may cause a stack-based buffer overflow. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges. An attacker would need to have valid administrative credentials to exploit this vulnerability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-buffer-cSdmfWUt; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-buffer-cSdmfWUt
CVE: CVE-2020-3546
Published: 2020-09-04
Description: A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to access sensitive information on an affected device. The vulnerability is due to insufficient validation of requests that are sent to the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the interface of an affected device. A successful exploit could allow the attacker to obtain the IP addresses that are configured on the internal interfaces of the affected device. There is a workaround that addresses this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-info-disclosure-vMJMMgJ; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-info-disclosure-vMJMMgJ
CVE: CVE-2020-3547
Published: 2020-09-04
Description: A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because an insecure method is used to mask certain passwords on the web-based management interface. An attacker could exploit this vulnerability by looking at the raw HTML code that is received from the interface. A successful exploit could allow the attacker to obtain some of the passwords configured throughout the interface.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-522
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-wsa-esa-info-dis-vsvPzOHP
CVE: CVE-2020-11493
Published: 2020-09-04
Description: In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information about an uninitialized object because of direct transformation from PDF Object to Stream without concern for a crafted XObject.
CVSS Score: 8.1 (HIGH)
CWE: CWE-345
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-12247
Published: 2020-09-04
Description: In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-12248
Published: 2020-09-04
Description: In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://www.foxitsoftware.com/support/security-bulletins.php; https://www.foxitsoftware.com/support/security-bulletins.php
CVE: CVE-2020-23834
Published: 2020-09-04
Description: Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://github.com/boku7/BarracudaDrivev6.5-LocalPrivEsc; https://www.exploit-db.com/exploits/48789; https://github.com/boku7/BarracudaDrivev6.5-LocalPrivEsc
CVE: CVE-2020-25021
Published: 2020-09-04
Description: An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787
References: http://packetstormsecurity.com/files/159057/Noise-Java-ChaChaPolyCipherState.encryptWithAd-Insufficient-Boundary-Checks.html; http://seclists.org/fulldisclosure/2020/Sep/14; https://github.com/rweather/noise-java/commit/18e86b6f8bea[PII_REDACTED]aa9ffa705ebf4bde90
CVE: CVE-2020-25022
Published: 2020-09-04
Description: An issue was discovered in Noise-Java through 2020-08-27. AESGCMFallbackCipherState.encryptWithAd() allows out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787
References: http://packetstormsecurity.com/files/159055/Noise-Java-AESGCMFallbackCipherState.encryptWithAd-Insufficient-Boundary-Checks.html; http://seclists.org/fulldisclosure/2020/Sep/11; https://github.com/rweather/noise-java/commit/18e86b6f8bea[PII_REDACTED]aa9ffa705ebf4bde90
CVE: CVE-2020-25023
Published: 2020-09-04
Description: An issue was discovered in Noise-Java through 2020-08-27. AESGCMOnCtrCipherState.encryptWithAd() allows out-of-bounds access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125, CWE-787
References: http://packetstormsecurity.com/files/159056/Noise-Java-AESGCMOnCtrCipherState.encryptWithAd-Insufficient-Boundary-Checks.html; http://seclists.org/fulldisclosure/2020/Sep/13; https://github.com/rweather/noise-java/commit/18e86b6f8bea[PII_REDACTED]aa9ffa705ebf4bde90
CVE: CVE-2020-7730
Published: 2020-09-04
Description: The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6; https://snyk.io/vuln/SNYK-JS-BESTZIP-609371; https://github.com/nfriedly/node-bestzip/commit/45d4a901478c6a8f396c8b959dd6cf8fd3f955b6
CVE: CVE-2019-3881
Published: 2020-09-04
Description: Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does not have a writable home directory, an attacker could place malicious code in this directory that would be later loaded and executed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://bugzilla.redhat.com/show_bug.cgi?id=1651826; https://bugzilla.redhat.com/show_bug.cgi?id=1651826
CVE: CVE-2020-7119
Published: 2020-09-04
Description: A vulnerability exists in the Aruba Analytics and Location Engine (ALE) web management interface 2.1.0.2 and earlier firmware that allows an already authenticated administrative user to arbitrarily modify files as an underlying privileged operating system user.
CVSS Score: 4.9 (MEDIUM)
References: https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-008.txt; https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-008.txt
CVE: CVE-2020-4545
Published: 2020-09-04
Description: IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link Libraries by the import feature. By persuading a victim to open a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 183190.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183190; https://www.ibm.com/support/pages/node/6326537; https://exchange.xforce.ibmcloud.com/vulnerabilities/183190
CVE: CVE-2020-4632
Published: 2020-09-04
Description: IBM InfoSphere Metadata Asset Manager 11.7 is vulnerable to server-side request forgery. By sending a specially crafted request, a remote authenticated attacker could exploit this vulnerability to submit or control server requests. IBM X-Force ID: 185416.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185416; https://www.ibm.com/support/pages/node/6323721; https://exchange.xforce.ibmcloud.com/vulnerabilities/185416
CVE: CVE-2020-4702
Published: 2020-09-04
Description: IBM InfoSphere Information Server 11.7 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187187.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187187; https://www.ibm.com/support/pages/node/6323721; https://exchange.xforce.ibmcloud.com/vulnerabilities/187187
CVE: CVE-2020-7299
Published: 2020-09-04
Description: Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key (TK) prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific situations.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://service.mcafee.com/webcenter/portal/oracle/webcenter/page/scopedMD/s55728c97_466d_4ddb_952d_05484ea932c6/Page29.jspx?wc.contextURL=%2Fspaces%2Fcp&articleId=TS103066&_afrLoop=[PII_REDACTED]&leftWidth=0%25&showFooter=false&showHeader=false&rightWidth=0%25&centerWidth=100%25; https://service.mcafee.com/webcenter/portal/oracle/webcenter/page/scopedMD/s55728c97_466d_4ddb_952d_05484ea932c6/Page29.jspx?wc.contextURL=%2Fspaces%2Fcp&articleId=TS103066&_afrLoop=[PII_REDACTED]&leftWidth=0%25&showFooter=false&showHeader=false&rightWidth=0%25&centerWidth=100%25
CVE: CVE-2020-14008
Published: 2020-09-04
Description: Zoho ManageEngine Applications Manager 14710 and before allows an authenticated admin user to upload a vulnerable jar in a specific location, which leads to remote code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/159066/ManageEngine-Applications-Manager-Authenticated-Remote-Code-Execution.html; https://www.manageengine.com; https://www.manageengine.com/products/applications_manager/issues.html#14730
CVE: CVE-2020-24659
Published: 2020-09-04
Description: An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00054.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00060.html; https://gitlab.com/gnutls/gnutls/-/issues/1071
CVE: CVE-2020-24963
Published: 2020-09-04
Description: An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://ex-mi.ru/exploit/%5B2020-08-23%5D-%5BPHP%5D-best-support-system-v3.0.4.txt; https://medium.com/%40ex.mi/php-best-support-system-v3-0-4-authenticated-persistent-xss-dfe6d4a06f75; https://ex-mi.ru/exploit/%5B2020-08-23%5D-%5BPHP%5D-best-support-system-v3.0.4.txt
CVE: CVE-2019-20916
Published: 2020-09-04
Description: The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00010.html; https://github.com/gzpan123/pip/commit/a4c735b14a62f9cb864533808ac63936704f2ace
CVE: CVE-2020-24981
Published: 2020-09-04
Description: An Incorrect Access Control vulnerability exists in /ucms/chk.php in UCMS 1.4.8. This results in information leak via an error message caused by directly accessing the website built by UCMS.
CVSS Score: 5.3 (MEDIUM)
References: https://sunian.top/2020/08/26/ucms-Incorrect%20Access%20Control/; https://sunian.top/2020/08/26/ucms-Incorrect%20Access%20Control/
CVE: CVE-2020-24986
Published: 2020-09-04
Description: Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://hackerone.com/reports/768322; https://hackerone.com/reports/768322
CVE: CVE-2020-24987
Published: 2020-09-04
Description: Tenda AC18 Router through V15.03.05.05_EN and through V15.03.05.19(6318) CN devices could cause a remote code execution due to incorrect authentication handling of vulnerable logincheck() function in /usr/lib/lua/ngx_authserver/ngx_wdas.lua file if the administrator UI Interface is set to "radius".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cwe.mitre.org/data/definitions/287.html; https://drive.google.com/file/d/1iqpr0EofOBC6kCq2USTOBPRlJu_naFjQ/view?usp=sharing; https://www.tendacn.com/en/product/AC18.html
CVE: CVE-2020-15709
Published: 2020-09-05
Description: Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://git.launchpad.net/software-properties/commit/add-apt-repository?id=97e2fe7d181e8711e0f5253d3b8db40426c17f1e; https://git.launchpad.net/software-properties/commit/add-apt-repository?id=97e2fe7d181e8711e0f5253d3b8db40426c17f1e
CVE: CVE-2018-13903
Published: 2020-09-08
Description: u'Error in UE due to race condition in EPCO handling' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, MDM9205, MDM9206, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, SDM450, SM8150
CVSS Score: 8.1 (HIGH)
CWE: CWE-362, CWE-476
References: https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
CVE: CVE-2019-10527
Published: 2020-09-08
Description: u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SMEM address range which could lead to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Bitra, IPQ6018, IPQ8074, Kamorta, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA4531, QCA6574AU, QCA8081, QCM2150, QCN7605, QCN7606, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SA415M, SA515M, SA6155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-129, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
CVE: CVE-2019-10562
Published: 2020-09-08
Description: u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memory and leads to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, Kamorta, MSM8998, Nicobar, QCS404, QCS605, QCS610, Rennell, SA415M, SA6155P, SC7180, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-287, CWE-347
References: https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
CVE: CVE-2019-10596
Published: 2020-09-08
Description: u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Bitra, Nicobar, QCS605, QCS610, Rennell, SA6155P, Saipan, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
CVE: CVE-2019-10615
Published: 2020-09-08
Description: u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of keymaster bob which can lead to memory corruption' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SA415M, SA515M, SA6155P, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin
CVE: CVE-2019-10628
Published: 2020-09-08
Description: u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8098, Bitra, MDM9205, MDM9650, MSM8998, Nicobar, QCA6390, QCN7605, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA6155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin; https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin