deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-3785
Published: 2020-03-25
Description: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-14.html; https://helpx.adobe.com/security/products/photoshop/apsb20-14.html
CVE: CVE-2020-3786
Published: 2020-03-25
Description: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-14.html; https://helpx.adobe.com/security/products/photoshop/apsb20-14.html
CVE: CVE-2020-3787
Published: 2020-03-25
Description: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-14.html; https://helpx.adobe.com/security/products/photoshop/apsb20-14.html
CVE: CVE-2020-3788
Published: 2020-03-25
Description: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-14.html; https://helpx.adobe.com/security/products/photoshop/apsb20-14.html
CVE: CVE-2020-3789
Published: 2020-03-25
Description: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-14.html; https://helpx.adobe.com/security/products/photoshop/apsb20-14.html
CVE: CVE-2020-3790
Published: 2020-03-25
Description: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/photoshop/apsb20-14.html; https://helpx.adobe.com/security/products/photoshop/apsb20-14.html
CVE: CVE-2020-3791
Published: 2020-03-25
Description: Adobe Photoshop CC 2019 versions 20.0.8 and earlier, and Photoshop 2020 versions 21.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/photoshop/apsb20-14.html; https://helpx.adobe.com/security/products/photoshop/apsb20-14.html
CVE: CVE-2020-9520
Published: 2020-03-25
Description: A stored XSS vulnerability was discovered in Micro Focus Vibe, affecting all Vibe version prior to 4.0.7. The vulnerability could allows a remote attacker to craft and store malicious content into Vibe such that when the content is viewed by another user of the system, attacker controlled JavaScript will execute in the security context of the target user’s browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2020/Mar/50; https://softwaresupport.softwaregrp.com/doc/KM03630475; http://seclists.org/fulldisclosure/2020/Mar/50
CVE: CVE-2020-10963
Published: 2020-03-25
Description: FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/160243/Laravel-Administrator-4-File-Upload.html; https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/; http://packetstormsecurity.com/files/160243/Laravel-Administrator-4-File-Upload.html
CVE: CVE-2020-10964
Published: 2020-03-25
Description: Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://blog.s9y.org/archives/290-Serendipity-2.3.4-released-security-update.html; https://github.com/s9y/Serendipity/releases/tag/2.3.4; https://blog.s9y.org/archives/290-Serendipity-2.3.4-released-security-update.html
CVE: CVE-2020-6805
Published: 2020-03-25
Description: When removing data about an origin whose tab was recently closed, a use-after-free could occur in the Quota manager, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1610880; https://usn.ubuntu.com/4328-1/; https://usn.ubuntu.com/4335-1/
CVE: CVE-2020-6806
Published: 2020-03-25
Description: By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125
References: http://packetstormsecurity.com/files/157524/Firefox-js-ReadableStreamCloseInternal-Out-Of-Bounds-Access.html; https://bugzilla.mozilla.org/show_bug.cgi?id=1612308; https://usn.ubuntu.com/4328-1/
CVE: CVE-2020-6807
Published: 2020-03-25
Description: When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1614971; https://usn.ubuntu.com/4328-1/; https://usn.ubuntu.com/4335-1/
CVE: CVE-2020-6808
Published: 2020-03-25
Description: When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1247968; https://www.mozilla.org/security/advisories/mfsa2020-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1247968
CVE: CVE-2020-6809
Published: 2020-03-25
Description: When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. This vulnerability affects Firefox < 74.
CVSS Score: 7.5 (HIGH)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1420296; https://www.mozilla.org/security/advisories/mfsa2020-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1420296
CVE: CVE-2020-6810
Published: 2020-03-25
Description: After a website had entered fullscreen mode, it could have used a previously opened popup to obscure the notification that indicates the browser is in fullscreen mode. Combined with spoofing the browser chrome, this could have led to confusing the user about the current origin of the page and credential theft or other attacks. This vulnerability affects Firefox < 74.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1432856; https://www.mozilla.org/security/advisories/mfsa2020-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1432856
CVE: CVE-2020-6811
Published: 2020-03-25
Description: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1607742; https://usn.ubuntu.com/4328-1/; https://usn.ubuntu.com/4335-1/
CVE: CVE-2020-6812
Published: 2020-03-25
Description: The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1616661; https://usn.ubuntu.com/4328-1/; https://usn.ubuntu.com/4335-1/
CVE: CVE-2020-6813
Published: 2020-03-25
Description: When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox < 74.
CVSS Score: 5.3 (MEDIUM)
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1605814; https://www.mozilla.org/security/advisories/mfsa2020-08/; https://bugzilla.mozilla.org/show_bug.cgi?id=1605814
CVE: CVE-2020-6814
Published: 2020-03-25
Description: Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1592078%2C1604847%2C1608256%2C1612636%2C1614339; https://usn.ubuntu.com/4328-1/; https://usn.ubuntu.com/4335-1/
CVE: CVE-2020-6815
Published: 2020-03-25
Description: Mozilla developers reported memory safety and script safety bugs present in Firefox 73. Some of these bugs showed evidence of memory corruption or escalation of privilege and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 74.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bugzilla.mozilla.org/buglist.cgi?bug_id=1181957%2C1557732%2C1557739%2C1611457%2C1612431; https://www.mozilla.org/security/advisories/mfsa2020-08/; https://bugzilla.mozilla.org/buglist.cgi?bug_id=1181957%2C1557732%2C1557739%2C1611457%2C1612431
CVE: CVE-2020-10965
Published: 2020-03-25
Description: Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the default admin account. This vulnerability only exists when the default admin account is not disabled. It is fixed in 20.01.1 and 19.11.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-306
References: https://healdb.tech/blog.html; https://help.teradici.com/s/article/3729; https://healdb.tech/blog.html
CVE: CVE-2020-10966
Published: 2020-03-25
Description: In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/hestiacp/hestiacp/issues/748; https://github.com/hestiacp/hestiacp/releases/tag/1.1.1; https://github.com/serghey-rodin/vesta/commit/c3c4de43d6701560f604ca7996f717b08e3d7d1d
CVE: CVE-2020-10245
Published: 2020-03-26
Description: CODESYS V3 web server before 3.5.15.40, as used in CODESYS Control runtime systems, has a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13078&token=de344ca65252463cc581ef144e0c53bd97b8f211&download=; https://www.tenable.com/security/research/tra-2020-16; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13078&token=de344ca65252463cc581ef144e0c53bd97b8f211&download=
CVE: CVE-2020-8910
Published: 2020-03-26
Description: A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation: update your library to version v20200315.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-625
References: https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9; https://github.com/google/closure-library/releases/tag/v20200315; https://github.com/google/closure-library/commit/294fc00b01d248419d8f8de37580adf2a0024fc9
CVE: CVE-2020-8923
Published: 2020-03-26
Description: An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627; https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627
CVE: CVE-2019-15795
Published: 2020-03-26
Description: python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-327, CWE-327
References: https://usn.ubuntu.com/4247-1/; https://usn.ubuntu.com/4247-3/; https://usn.ubuntu.com/4247-1/
CVE: CVE-2019-15796
Published: 2020-03-26
Description: Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-287, CWE-347
References: https://usn.ubuntu.com/4247-1/; https://usn.ubuntu.com/4247-3/; https://usn.ubuntu.com/4247-1/
CVE: CVE-2020-10968
Published: 2020-03-26
Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/FasterXML/jackson-databind/issues/2662; https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html; https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
CVE: CVE-2020-10969
Published: 2020-03-26
Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
CVSS Score: 8.8 (HIGH)
CWE: CWE-502, CWE-502
References: https://github.com/FasterXML/jackson-databind/issues/2642; https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html; https://medium.com/%40cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062
CVE: CVE-2020-1764
Published: 2020-03-26
Description: A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alter the Istio configuration.
CVSS Score: 8.6 (HIGH)
CWE: CWE-321, CWE-798
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764; https://kiali.io/news/security-bulletins/kiali-security-001/; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1764
CVE: CVE-2020-5129
Published: 2020-03-26
Description: A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of Service. This vulnerability affected SMA1000 Version 12.1.0-06411 and earlier.
CVSS Score: 7.5 (HIGH)
CWE: CWE-248, CWE-444
References: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0002; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0002
CVE: CVE-2020-5339
Published: 2020-03-26
Description: RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators open the affected report page, the injected scripts could potentially be executed in their browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.rsa.com/docs/DOC-111092; https://community.rsa.com/docs/DOC-111092
CVE: CVE-2020-5340
Published: 2020-03-26
Description: RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript code through the Security Console web interface. When other Security Console administrators attempt to change the default security domain mapping, the injected scripts could potentially be executed in their browser.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.rsa.com/docs/DOC-111092; https://community.rsa.com/docs/DOC-111092
CVE: CVE-2020-6999
Published: 2020-03-26
Description: In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size for its buffer.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120, CWE-120
References: https://www.us-cert.gov/ics/advisories/icsa-20-056-04; https://www.us-cert.gov/ics/advisories/icsa-20-056-04
CVE: CVE-2020-7260
Published: 2020-03-26
Description: DLL Side Loading vulnerability in the installer for McAfee Application and Change Control (MACC) prior to 8.3 allows local users to execute arbitrary code via execution from a compromised folder.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264, CWE-426
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10313; https://kc.mcafee.com/corporate/index?page=content&id=SB10313
CVE: CVE-2020-4276
Published: 2020-03-26
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. X-Force ID: 175984.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175984; https://www.ibm.com/support/pages/node/6118222; https://exchange.xforce.ibmcloud.com/vulnerabilities/175984
CVE: CVE-2019-5105
Published: 2020-03-26
Description: An exploitable memory corruption vulnerability exists in the Name Service Client functionality of 3S-Smart Software Solutions CODESYS GatewayService. A specially crafted packet can cause a large memcpy, resulting in an access violation and termination of the process. An attacker can send a packet to a device running the GatewayService.exe to trigger this vulnerability. All variants of the CODESYS V3 products in all versions prior V3.5.16.10 containing the CmpRouter or CmpRouterEmbedded component are affected, regardless of the CPU type or operating system: CODESYS Control for BeagleBone, CODESYS Control for emPC-A/iMX6, CODESYS Control for IOT2000, CODESYS Control for Linux, CODESYS Control for PLCnext, CODESYS Control for PFC100, CODESYS Control for PFC200, CODESYS Control for Raspberry Pi, CODESYS Control RTE V3, CODESYS Control RTE V3 (for Beckhoff CX), CODESYS Control Win V3 (also part of the CODESYS Development System setup), CODESYS Control V3 Runtime System Toolkit, CODESYS V3 Embedded Target Visu Toolkit, CODESYS V3 Remote Target Visu Toolkit, CODESYS V3 Safety SIL2, CODESYS Edge Gateway V3, CODESYS Gateway V3, CODESYS HMI V3, CODESYS OPC Server V3, CODESYS PLCHandler SDK, CODESYS V3 Simulation Runtime (part of the CODESYS Development System).
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13077&token=3bfc6d1d08415a6260b[PII_REDACTED]1f5786e7fd4&download=; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0897; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13077&token=3bfc6d1d08415a6260b[PII_REDACTED]1f5786e7fd4&download=
CVE: CVE-2020-1800
Published: 2020-03-26
Description: HUAWEI smartphones P30 with versions earlier than 10.0.0.185(C00E85R1P11) have an improper access control vulnerability. The software incorrectly restricts access to a function interface from an unauthorized actor, the attacker tricks the user into installing a crafted application, successful exploit could allow the attacker do certain unauthenticated operations.
CVSS Score: 7.8 (HIGH)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200325-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200325-02-smartphone-en
CVE: CVE-2020-7944
Published: 2020-03-26
Description: In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive parameters ending up in the impact analysis report.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200
References: https://puppet.com/security/cve/CVE-2020-7944; https://puppet.com/security/cve/CVE-2020-7944
CVE: CVE-2020-9065
Published: 2020-03-26
Description: Huawei smart phone Taurus-AL00B with versions earlier than 10.0.0.203(C00E201R7P2) have a use-after-free (UAF) vulnerability. An authenticated, local attacker may perform specific operations to exploit this vulnerability. Successful exploitation may tamper with the information to affect the availability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200325-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200325-01-smartphone-en
CVE: CVE-2020-9066
Published: 2020-03-26
Description: Huawei smartphones OxfordP-AN10B with versions earlier than 10.0.1.169(C00E166R4P1) have an improper authentication vulnerability. The Application doesn't perform proper authentication when user performs certain operations. An attacker can trick user into installing a malicious plug-in to exploit this vulnerability. Successful exploit could allow the attacker to bypass the authentication to perform unauthorized operations.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200325-01-phone; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200325-01-phone