deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15262
Published: 2020-10-19
Description: In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. This issue is patched in version 1.5.1.
CVSS Score: 3.7 (LOW)
CWE: CWE-345, CWE-345
References: https://github.com/waysact/webpack-subresource-integrity/commit/3d7090c08c333fcfb10ad9e2d6cf72e2acb7d87f; https://github.com/waysact/webpack-subresource-integrity/issues/131; https://github.com/waysact/webpack-subresource-integrity/security/advisories/GHSA-4fc4-chg7-h8gh
CVE: CVE-2020-24387
Published: 2020-10-19
Description: An issue was discovered in the yh_create_session() function of yubihsm-shell through 2.0.2. The function does not explicitly check the returned session id from the device. An invalid session id would lead to out-of-bounds read and write operations in the session array. This could be used by an attacker to cause a denial of service attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125, CWE-787
References: https://blog.inhq.net/posts/yubico-libyubihsm-vuln/; https://developers.yubico.com/yubihsm-shell/; https://github.com/Yubico/yubihsm-shell
CVE: CVE-2020-24388
Published: 2020-10-19
Description: An issue was discovered in the _send_secure_msg() function of yubihsm-shell through 2.0.2. The function does not validate the embedded length field of a message received from the device. This could lead to an oversized memcpy() call that will crash the running process. This could be used by an attacker to cause a denial of service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-787
References: https://blog.inhq.net/posts/yubico-libyubihsm-vuln/; https://developers.yubico.com/yubihsm-shell/; https://github.com/Yubico/yubihsm-shell
CVE: CVE-2020-9092
Published: 2020-10-19
Description: HUAWEI Mate 20 versions earlier than 10.1.0.163(C00E160R3P8) have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-79
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-01-smartphone-en
CVE: CVE-2020-9111
Published: 2020-10-19
Description: E6878-370 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP21C233) and E6878-870 versions 10.0.3.1(H557SP27C233),10.0.3.1(H563SP11C233) have a denial of service vulnerability. The system does not properly check some events, an attacker could launch the events continually, successful exploit could cause reboot of the process.
CVSS Score: 4.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-02-dos-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-02-dos-en
CVE: CVE-2020-9112
Published: 2020-10-19
Description: Taurus-AN00B versions earlier than 10.1.0.156(C00E155R7P2) have a privilege elevation vulnerability. Due to lack of privilege restrictions on some of the business functions of the device. An attacker could exploit this vulnerability to access the protecting information, resulting in the elevation of the privilege.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-01-privilege-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-01-privilege-en
CVE: CVE-2020-9113
Published: 2020-10-19
Description: HUAWEI Mate 20 versions earlier than 10.0.0.188(C00E74R3P8) have a buffer overflow vulnerability in the Bluetooth module. Due to insufficient input validation, an unauthenticated attacker may craft Bluetooth messages after successful paring, causing buffer overflow. Successful exploit may cause code execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-01-bluetooth-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20201014-01-bluetooth-en
CVE: CVE-2020-9263
Published: 2020-10-19
Description: HUAWEI Mate 30 versions earlier than 10.1.0.150(C00E136R5P3) and HUAWEI P30 version earlier than 10.1.0.160(C00E160R2P11) have a use after free vulnerability. There is a condition exists that the system would reference memory after it has been freed, the attacker should trick the user into running a crafted application with common privilege, successful exploit could cause code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200701-07-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200701-07-smartphone-en
CVE: CVE-2020-10746
Published: 2020-10-19
Description: A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=1835922; https://bugzilla.redhat.com/show_bug.cgi?id=1835922
CVE: CVE-2020-13937
Published: 2020-10-19
Description: Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-922
References: https://lists.apache.org/thread.html/rc592e0dcee5a2615f1d9522af30ef1822c1f863d5e05e7da9d1e57f4%40%3Cuser.kylin.apache.org%3E; https://lists.apache.org/thread.html/rc592e0dcee5a2615f1d9522af30ef1822c1f863d5e05e7da9d1e57f4%40%3Cuser.kylin.apache.org%3E
CVE: CVE-2020-15245
Published: 2020-10-19
Description: In Sylius before versions 1.6.9, 1.7.9 and 1.8.3, the user may register in a shop by email mail@example.com, verify it, change it to the mail another@domain.com and stay verified and enabled. This may lead to having accounts addressed to totally different emails, that were verified. Note, that this way one is not able to take over any existing account (guest or normal one). The issue has been patched in Sylius 1.6.9, 1.7.9 and 1.8.3. As a workaround, you may resolve this issue on your own by creating a custom event listener, which will listen to the sylius.customer.pre_update event. You can determine that email has been changed if customer email and user username are different. They are synchronized later on. Pay attention, to email changing behavior for administrators. You may need to skip this logic for them. In order to achieve this, you should either check master request path info, if it does not contain /admin prefix or adjust event triggered during customer update in the shop. You can find more information on how to customize the event here.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79, CWE-862
References: https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf; https://github.com/Sylius/Sylius/security/advisories/GHSA-6gw4-x63h-5499; https://github.com/Sylius/Sylius/commit/60636d711a4011e8694d10d201b53632c7e8ecaf
CVE: CVE-2020-15263
Published: 2020-10-19
Description: In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169; https://github.com/orchidsoftware/platform/security/advisories/GHSA-589w-hccm-265x; https://github.com/orchidsoftware/platform/commit/03f9a113b1a70bc5075ce86a918707f0e7d82169
CVE: CVE-2020-6084
Published: 2020-10-19
Description: An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability by sending an Electronic Key Segment with less bytes than required by the Key Format Table.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1006; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1006
CVE: CVE-2020-6085
Published: 2020-10-19
Description: An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A specially crafted network request can cause a loss of communications with the device resulting in denial-of-service. An attacker can send a malicious packet to trigger this vulnerability by sending an Electronic Key Segment with less than 0x18 bytes following the Key Format field.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120, CWE-120
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1006; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1006
CVE: CVE-2020-15256
Published: 2020-10-19
Description: A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-471
References: https://github.com/mariocasciaro/object-path/commit/2be3354c6c46215c7635eb1b76d80f1319403c68; https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w; https://github.com/mariocasciaro/object-path/commit/2be3354c6c46215c7635eb1b76d80f1319403c68
CVE: CVE-2020-15261
Published: 2020-10-19
Description: On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users (both students and teachers) usually don't have administrative privileges, this vulnerability is only dangerous in anyway unsafe setups. The problem has been fixed in version 4.4.2. As a workaround, the exploitation of the vulnerability can be prevented by revoking administrative privileges from all potentially untrustworthy users.
CVSS Score: 8.0 (HIGH)
CWE: CWE-428
References: http://packetstormsecurity.com/files/162873/Veyon-4.4.1-Unquoted-Service-Path.html; https://github.com/veyon/veyon/commit/f231ec511b9a09f43f49b2c7bb7c60b8046276b1; https://github.com/veyon/veyon/issues/657
CVE: CVE-2020-5640
Published: 2020-10-20
Description: Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive information via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
References: https://jvn.jp/en/vu/JVNVU99467898/index.html; https://onethird.net/en/p1340.html; https://jvn.jp/en/vu/JVNVU99467898/index.html
CVE: CVE-2020-7747
Published: 2020-10-20
Description: This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js%23L230; https://snyk.io/vuln/SNYK-JS-LIGHTNINGSERVER-1019381; https://github.com/lightning-viz/lightning/blob/master/app/controllers/session.js
CVE: CVE-2020-7748
Published: 2020-10-20
Description: This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-1321
References: https://github.com/TypedProject/tsed/blob/production/packages/core/src/utils/deepExtends.ts%23L36; https://github.com/TypedProject/tsed/commit/1395773ddac35926cf058fc6da9fb8e82266761b; https://snyk.io/vuln/SNYK-JS-TSEDCORE-1019382
CVE: CVE-2020-7749
Published: 2020-10-20
Description: This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.
CVSS Score: 7.6 (HIGH)
CWE: CWE-74, CWE-79
References: https://github.com/jperelli/osm-static-maps/blob/master/src/template.html%23L142; https://github.com/jperelli/osm-static-maps/pull/24; https://snyk.io/vuln/SNYK-JS-OSMSTATICMAPS-609637
CVE: CVE-2020-6308
Published: 2020-10-20
Description: SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. On successful exploitation, attacker can scan internal network to determine internal infrastructure and gather information for further attacks like remote file inclusion, retrieve server files, bypass firewall and force the vulnerable server to perform malicious requests, resulting in a Server-Side Request Forgery vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://launchpad.support.sap.com/#/notes/2943844; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2943844
CVE: CVE-2020-6315
Published: 2020-10-20
Description: SAP 3D Visual Enterprise Viewer, version 9, allows an attacker to send certain manipulated file to the victim, which can lead to leakage of sensitive information when the victim loads the malicious file into the VE viewer, leading to Information Disclosure.
CVSS Score: 5.5 (MEDIUM)
References: https://launchpad.support.sap.com/#/notes/2973497; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2973497
CVE: CVE-2020-6362
Published: 2020-10-20
Description: SAP Banking Services version 500, use an incorrect authorization object in some of its reports. Although the affected reports are protected with otherauthorization objects, exploitation of the vulnerability could lead to privilege escalation and violation in segregation of duties, which in turn could lead to Service interruptions and system unavailability for the victim and users of the component.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://launchpad.support.sap.com/#/notes/2953212; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2953212
CVE: CVE-2020-6366
Published: 2020-10-20
Description: SAP NetWeaver (Compare Systems) versions - 7.20, 7.30, 7.40, 7.50, does not sufficiently validate uploaded XML documents. An attacker with administrative privileges can retrieve arbitrary files including files on OS level from the server and/or can execute a denial-of-service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2969457; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2969457
CVE: CVE-2020-6367
Published: 2020-10-20
Description: There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2972661; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2972661
CVE: CVE-2020-6369
Published: 2020-10-20
Description: SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the authentication if the default passwords for Admin and Guest have not been changed by the administrator.This may impact the confidentiality of the service.
CVSS Score: 5.9 (MEDIUM)
References: http://packetstormsecurity.com/files/163159/SAP-Wily-Introscope-Enterprise-Default-Hard-Coded-Credentials.html; http://seclists.org/fulldisclosure/2021/Jun/31; https://launchpad.support.sap.com/#/notes/2971638
CVE: CVE-2020-6370
Published: 2020-10-20
Description: SAP NetWeaver Design Time Repository (DTR), versions - 7.11, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2939419; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=558632196; https://launchpad.support.sap.com/#/notes/2939419
CVE: CVE-2019-4680
Published: 2020-10-20
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.2.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 171733.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/171733; https://www.ibm.com/support/pages/node/6349515; https://exchange.xforce.ibmcloud.com/vulnerabilities/171733
CVE: CVE-2020-16246
Published: 2020-10-20
Description: The affected Reason S20 Ethernet Switch is vulnerable to cross-site scripting (XSS), which may allow attackers to trick users into following a link or navigating to a page that posts a malicious JavaScript statement to the vulnerable site, causing the malicious JavaScript to be rendered by the site and executed by the victim client.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02; https://us-cert.cisa.gov/ics/advisories/icsa-20-266-02
CVE: CVE-2020-4491
Published: 2020-10-20
Description: IBM Spectrum Scale V4.2.0.0 through V4.2.3.22 and V5.0.0.0 through V5.0.5 could allow a local attacker to cause a denial of service by sending a large number of RPC requests to the mmfsd daemon which would cause the service to crash. IBM X-Force ID: 181991.
CVSS Score: 5.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181991; https://www.ibm.com/support/pages/node/6349465; https://exchange.xforce.ibmcloud.com/vulnerabilities/181991
CVE: CVE-2020-4564
Published: 2020-10-20
Description: IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.0.3.1 and IBM Sterling File Gateway 2.2.0.0 through 6.0.3.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 183933.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/183933; https://www.ibm.com/support/pages/node/6349533; https://www.ibm.com/support/pages/node/6349539
CVE: CVE-2020-4748
Published: 2020-10-20
Description: IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188517.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188517; https://www.ibm.com/support/pages/node/6349449; https://exchange.xforce.ibmcloud.com/vulnerabilities/188517
CVE: CVE-2020-4749
Published: 2020-10-20
Description: IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 188518.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-565
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188518; https://www.ibm.com/support/pages/node/6349449; https://exchange.xforce.ibmcloud.com/vulnerabilities/188518
CVE: CVE-2020-4755
Published: 2020-10-20
Description: IBM Spectrum Scale 5.0.0 through 5.0.5.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 188595.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188595; https://www.ibm.com/support/pages/node/6349449; https://exchange.xforce.ibmcloud.com/vulnerabilities/188595
CVE: CVE-2020-4756
Published: 2020-10-20
Description: IBM Spectrum Scale V4.2.0.0 through V4.2.3.23 and V5.0.0.0 through V5.0.5.2 as well as IBM Elastic Storage System 6.0.0 through 6.0.1.0 could allow a local attacker to invoke a subset of ioctls on the device with invalid arguments that could crash the keneral and cause a denial of service. IBM X-Force ID: 188599.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/188599; https://www.ibm.com/support/pages/node/6349469; https://www.ibm.com/support/pages/node/6349475
CVE: CVE-2020-3981
Published: 2020-10-20
Description: VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi[PII_REDACTED]01-SG, 6.5 before ESXi[PII_REDACTED]01-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds read vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this issue to leak memory from the vmx process.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-125, CWE-367
References: https://www.vmware.com/security/advisories/VMSA-2020-0023.html; https://www.vmware.com/security/advisories/VMSA-2020-0023.html
CVE: CVE-2020-3982
Published: 2020-10-20
Description: VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi[PII_REDACTED]01-SG, 6.5 before ESXi[PII_REDACTED]01-SG), Workstation (15.x), Fusion (11.x before 11.5.6) contain an out-of-bounds write vulnerability due to a time-of-check time-of-use issue in ACPI device. A malicious actor with administrative access to a virtual machine may be able to exploit this vulnerability to crash the virtual machine's vmx process or corrupt hypervisor's memory heap.
CVSS Score: 7.7 (HIGH)
CWE: CWE-367, CWE-787
References: https://www.vmware.com/security/advisories/VMSA-2020-0023.html; https://www.vmware.com/security/advisories/VMSA-2020-0023.html