deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-0424
Published: 2020-11-10
Description: In send_vc of res_send.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-161362564
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0437
Published: 2020-11-10
Description: In CellBroadcastReceiver's intent handlers, there is a possible denial of service due to a missing permission check. This could lead to local denial of service of emergency alerts with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-162741784
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0438
Published: 2020-11-10
Description: In the AIBinder_Class constructor of ibinder.cpp, there is a possible arbitrary code execution due to uninitialized data. This could lead to local escalation of privilege if a process were using libbinder_ndk in a vulnerable way with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-161812320
CVSS Score: 7.8 (HIGH)
CWE: CWE-824, CWE-909
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0439
Published: 2020-11-10
Description: In generatePackageInfo of PackageManagerService.java, there is a possible permissions bypass due to an incorrect permission check. This could lead to local escalation of privilege that allows instant apps access to permissions not allowed for instant apps, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-140256621
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0441
Published: 2020-11-10
Description: In Message and toBundle of Notification.java, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service requiring a device reset to fix with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-158304295
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0442
Published: 2020-11-10
Description: In Message and toBundle of Notification.java, there is a possible UI slowdown or crash due to improper input validation. This could lead to remote denial of service if a malicious contact file is received, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.0 Android-8.1 Android-9Android ID: A-147358092
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0443
Published: 2020-11-10
Description: In LocaleList of LocaleList.java, there is a possible forced reboot due to an uncaught exception. This could lead to local denial of service requiring factory reset to restore with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-152410253
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0445
Published: 2020-11-10
Description: There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264527
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0446
Published: 2020-11-10
Description: There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168264528
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0447
Published: 2020-11-10
Description: There is a possible out of bounds write due to a missing bounds check.Product: AndroidVersions: Android SoCAndroid ID: A-168251617
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0448
Published: 2020-11-10
Description: In getPhoneAccountsForPackage of TelecomServiceImpl.java, there is a possible way to access a tracking identifier due to a missing permission check. This could lead to local information disclosure of the identifier, which could be used to track an account across devices, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-153995334
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0449
Published: 2020-11-10
Description: In btm_sec_disconnected of btm_sec.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution in the Bluetooth server with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.0 Android-8.1Android ID: A-162497143
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0450
Published: 2020-11-10
Description: In rw_i93_sm_format of rw_i93.cc, there is a possible out of bounds read due to uninitialized data. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10 Android-11Android ID: A-157650336
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-665
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0451
Published: 2020-11-10
Description: In sbrDecoder_AssignQmfChannels2SbrChannels of sbrdecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9 Android-8.0 Android-8.1Android ID: A-158762825
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0452
Published: 2020-11-10
Description: In exif_entry_get_value of exif-entry.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution if a third party app used this library to process remote image data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-159625731
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELDZR6USD5PR34MRK2ZISLCYJ465FNKN/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVBD5JRUQPN4LQHTAAJHA3MR5M7YTAC7/; https://security.gentoo.org/glsa/202011-19
CVE: CVE-2020-0453
Published: 2020-11-10
Description: In updateNotification of BeamTransferManager.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-8.0 Android-8.1Android ID: A-159060474
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-11-01; https://source.android.com/security/bulletin/2020-11-01
CVE: CVE-2020-0454
Published: 2020-11-10
Description: In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of the current SSID with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-161370134
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-11-01; https://www.usenix.org/conference/usenixsecurity19/presentation/reardon; https://www.usenix.org/system/files/sec19-reardon.pdf
CVE: CVE-2020-24384
Published: 2020-11-10
Description: A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used to compromise affected ACOS systems. ACOS versions 3.2.x (including and after 3.2.2), 4.x, and 5.1.x are affected. aGalaxy versions 3.0.x, 3.2.x, and 5.0.x are affected.
CVSS Score: 9.8 (CRITICAL)
References: https://support.a10networks.com/support/security_advisory/acos-agalaxy-gui-rce-vulnerability-cve-2020-24384; https://support.a10networks.com/support/security_advisory/acos-agalaxy-gui-rce-vulnerability-cve-2020-24384
CVE: CVE-2020-4568
Published: 2020-11-10
Description: IBM Tivoli Key Lifecycle Manager 3.0, 3.0.1, and 4.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 184157.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/184157; https://www.ibm.com/support/pages/node/6365305; https://exchange.xforce.ibmcloud.com/vulnerabilities/184157
CVE: CVE-2020-4704
Published: 2020-11-10
Description: IBM Content Navigator 3.0CD is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 187189.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/187189; https://www.ibm.com/support/pages/node/6365327; https://exchange.xforce.ibmcloud.com/vulnerabilities/187189
CVE: CVE-2020-4760
Published: 2020-11-10
Description: IBM Content Navigator 3.0CD is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188737.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188737; https://www.ibm.com/support/pages/node/6365329; https://exchange.xforce.ibmcloud.com/vulnerabilities/188737
CVE: CVE-2020-5388
Published: 2020-11-10
Description: Dell Inspiron 15 7579 2-in-1 BIOS versions prior to 1.31.0 contain an Improper SMM communication buffer verification vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119, CWE-119
References: https://www.dell.com/support/article/en-us/sln322869/dsa-2020-215-dell-inspiron-15-7579-2-in-1-improper-smm-communication-buffer-boundary-verification-vulnerability; https://www.dell.com/support/article/en-us/sln322869/dsa-2020-215-dell-inspiron-15-7579-2-in-1-improper-smm-communication-buffer-boundary-verification-vulnerability
CVE: CVE-2020-12485
Published: 2020-11-10
Description: The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which caused out of the boundary when memory access.The vulnerability eventually leads to a local DOS on the device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.vivo.com/en/support/security-advisory-detail?id=2; https://www.vivo.com/en/support/security-advisory-detail?id=2
CVE: CVE-2020-13927
Published: 2020-11-10
Description: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-1188, CWE-306, CWE-1056, CWE-1188
References: http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html; http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html; https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
CVE: CVE-2020-28267
Published: 2020-11-10
Description: Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
CVSS Score: 7.5 (HIGH)
References: https://github.com/strikeentco/set/commit/102cc6b2e1d1e0c928ced87e75df759d5541ff60; https://www.whitesourcesoftware.com/vulnerability-database/CVE-2020-28267; https://github.com/strikeentco/set/commit/102cc6b2e1d1e0c928ced87e75df759d5541ff60
CVE: CVE-2020-7766
Published: 2020-11-10
Description: This affects all versions of package json-ptr. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
CVSS Score: 7.3 (HIGH)
CWE: CWE-1321
References: https://github.com/flitbit/json-ptr/blob/master/src/util.ts%23L174; https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038396; https://snyk.io/vuln/SNYK-JS-JSONPTR-1016939
CVE: CVE-2020-25074
Published: 2020-11-10
Description: The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://moinmo.in/SecurityFixes; https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq; https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html
CVE: CVE-2020-26807
Published: 2020-11-10
Description: SAP ERP Client for E-Bilanz, version - 1.0, installation sets Incorrect default filesystem permissions are set in its installation folder which allows anyone to modify the files in the folder.
CVSS Score: 3.3 (LOW)
CWE: CWE-276
References: https://launchpad.support.sap.com/#/notes/2971112; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2971112
CVE: CVE-2020-26808
Published: 2020-11-10
Description: SAP AS ABAP(DMIS), versions - 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 2011_1_731, 2011_1_752, 2020 and SAP S4 HANA(DMIS), versions - 101, 102, 103, 104, 105, allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality, availability and integrity of the application.
CVSS Score: 7.2 (HIGH)
References: http://packetstormsecurity.com/files/167229/SAP-Application-Server-ABAP-ABAP-Platform-Code-Injection-SQL-Injection-Missing-Authorization.html; http://seclists.org/fulldisclosure/2022/May/42; https://launchpad.support.sap.com/#/notes/2973735
CVE: CVE-2020-26809
Published: 2020-11-10
Description: SAP Commerce Cloud, versions- 1808,1811,1905,2005, allows an attacker to bypass existing authentication and permission checks via the '/medias' endpoint hence gaining access to Secure Media folders. This folder could contain sensitive files that results in disclosure of sensitive information and impact system configuration confidentiality.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-276
References: http://packetstormsecurity.com/files/163146/SAP-Hybris-eCommerce-Information-Disclosure.html; http://seclists.org/fulldisclosure/2021/Jun/27; https://launchpad.support.sap.com/#/notes/2975189
CVE: CVE-2020-26810
Published: 2020-11-10
Description: SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request can render the SAP Commerce service itself unavailable leading to Denial of Service with no impact on confidentiality or integrity.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2975170; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2975170
CVE: CVE-2020-26811
Published: 2020-11-10
Description: SAP Commerce Cloud (Accelerator Payment Mock), versions - 1808, 1811, 1905, 2005, allows an unauthenticated attacker to submit a crafted request over a network to a particular SAP Commerce module URL which will be processed without further interaction, the crafted request leads to Server Side Request Forgery attack which could lead to retrieval of limited pieces of information about the service with no impact on integrity or availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: http://packetstormsecurity.com/files/163143/SAP-Hybris-eCommerce-Server-Side-Request-Forgery.html; http://seclists.org/fulldisclosure/2021/Jun/26; https://launchpad.support.sap.com/#/notes/2975170
CVE: CVE-2020-26814
Published: 2020-11-10
Description: SAP Process Integration (PGP Module - Business-to-Business Add On), version - 1.0, allows an attacker to read PGP Keys under certain conditions in the PGP Module of Business-to-Business Add-On, these keys can then be used to read messages processed by the module leading to Information Disclosure.
CVSS Score: 4.9 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2952084; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2952084
CVE: CVE-2020-26815
Published: 2020-11-10
Description: SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources which are otherwise restricted for internal usage only, resulting in a Server-Side Request Forgery vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://launchpad.support.sap.com/#/notes/2984627; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2984627
CVE: CVE-2020-26817
Published: 2020-11-10
Description: SAP 3D Visual Enterprise Viewer, version - 9, allows an user to open manipulated HPGL file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://launchpad.support.sap.com/#/notes/2985094; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://www.zerodayinitiative.com/advisories/ZDI-20-1364/
CVE: CVE-2020-26818
Published: 2020-11-10
Description: SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, which reveals sensitive system information that would otherwise be restricted to highly privileged users because of missing authorization, resulting in Information Disclosure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2971954; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2971954
CVE: CVE-2020-26819
Published: 2020-11-10
Description: SAP NetWeaver AS ABAP (Web Dynpro), versions - 731, 740, 750, 751, 752, 753, 754, 755, 782, allows an authenticated user to access Web Dynpro components, that allows them to read and delete database logfiles because of Improper Access Control.
CVSS Score: 8.8 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2971954; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2971954
CVE: CVE-2020-26820
Published: 2020-11-10
Description: SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the file system and upload a malicious file. The attacker or another user can then use a separate mechanism to execute OS commands through the uploaded file leading to Privilege Escalation and completely compromise the confidentiality, integrity and availability of the server operating system and any application running on it.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/162086/SAP-Java-OS-Remote-Code-Execution.html; http://seclists.org/fulldisclosure/2021/Apr/7; https://launchpad.support.sap.com/#/notes/2979062
CVE: CVE-2020-26821
Published: 2020-11-10
Description: SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the SVG Converter Service, this has an impact to the integrity and availability of the service.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/2985866; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2985866
CVE: CVE-2020-26822
Published: 2020-11-10
Description: SAP Solution Manager (JAVA stack), version - 7.20, allows an unauthenticated attacker to compromise the system because of missing authorization checks in the Outside Discovery Configuration Service, this has an impact to the integrity and availability of the service.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-306
References: https://launchpad.support.sap.com/#/notes/2985866; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571; https://launchpad.support.sap.com/#/notes/2985866