deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-11514
Published: 2020-04-07
Description: The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to update arbitrary WordPress metadata, including the ability to escalate or revoke administrative privileges for existing users via the unsecured rankmath/v1/updateMeta REST API endpoint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://rankmath.com/changelog/; https://wordpress.org/plugins/seo-by-rank-math/#developers; https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
CVE: CVE-2020-11515
Published: 2020-04-07
Description: The Rank Math plugin through 1.0.40.2 for WordPress allows unauthenticated remote attackers to create new URIs (that redirect to an external web site) via the unsecured rankmath/v1/updateRedirection REST API endpoint. In other words, this is not an "Open Redirect" issue; instead, it allows the attacker to create a new URI with an arbitrary name (e.g., the /exampleredirect URI).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://rankmath.com/changelog/; https://wordpress.org/plugins/seo-by-rank-math/#developers; https://www.wordfence.com/blog/2020/03/critical-vulnerabilities-affecting-over-200000-sites-patched-in-rank-math-seo-plugin/
CVE: CVE-2020-11516
Published: 2020-04-07
Description: Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form, the JavaScript will be executed in their browser, which can then be used to create new administrative users or perform other actions using the administrator's session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-leads-to-closure-of-plugin-with-over-100000-installations/; https://www.wordfence.com/blog/2020/04/high-severity-vulnerability-leads-to-closure-of-plugin-with-over-100000-installations/
CVE: CVE-2020-11560
Published: 2020-04-07
Description: NCH Express Invoice 7.25 allows local users to discover the cleartext password by reading the configuration file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: http://packetstormsecurity.com/files/173117/NCH-Express-Invoice-7.25-Cleartext-Password.html; https://tejaspingulkar.blogspot.com/2020/03/cve-cve-2020-11560-title-clear-text.html; https://www.youtube.com/watch?v=V0BWq33qVCs&feature=youtu.be
CVE: CVE-2020-11609
Published: 2020-04-07
Description: An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html; https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=485b06aadb933190f4bc44e006076bc27a23f205
CVE: CVE-2020-9514
Published: 2020-04-07
Description: An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user (with the Subscriber role) to permanently delete arbitrary posts and pages, create new posts with arbitrary subjects, and modify the subjects of existing posts and pages (via create_dynamic_page and delete_dynamic_page).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://wordpress.org/plugins/idx-broker-platinum/#developers; https://www.wordfence.com/blog/2020/03/vulnerabilities-patched-in-impress-for-idx-broker/; https://wordpress.org/plugins/idx-broker-platinum/#developers
CVE: CVE-2013-7488
Published: 2020-04-07
Description: perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input.
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://github.com/gbarr/perl-Convert-ASN1/issues/14; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6V3PJEQOT47ZO77263XPGS3Y3AJROI4X/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ONNQSW4SSKMG5RUEFZJZA5T5R2WXEGQF/
CVE: CVE-2015-9544
Published: 2020-04-07
Description: An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://github.com/ofirdagan/cross-domain-local-storage; https://github.com/ofirdagan/cross-domain-local-storage/issues/17; https://github.com/ofirdagan/cross-domain-local-storage/pull/19
CVE: CVE-2015-9545
Published: 2020-04-07
Description: An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: https://github.com/ofirdagan/cross-domain-local-storage; https://github.com/ofirdagan/cross-domain-local-storage/issues/17; https://github.com/ofirdagan/cross-domain-local-storage/pull/19
CVE: CVE-2019-13554
Published: 2020-04-07
Description: GE Mark VIe Controller has an unsecured Telnet protocol that may allow a user to create an authenticated session using generic default credentials. GE recommends that users disable the Telnet service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-285
References: https://www.us-cert.gov/ics/advisories/icsa-19-281-02; https://www.us-cert.gov/ics/advisories/icsa-19-281-02
CVE: CVE-2019-13559
Published: 2020-04-07
Description: GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the affected product may ship without setup and configuration instructions immediately available to the end user. The bulk of controllers go into applications requiring the GE commissioning engineer to change default configurations during the installation process. GE recommends that users reset controller passwords during installation in the operating environment.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsa-19-281-02; https://www.us-cert.gov/ics/advisories/icsa-19-281-02
CVE: CVE-2019-17657
Published: 2020-04-07
Description: An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause admin webUI denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly, as demonstrated by Slow HTTP DoS Attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://fortiguard.com/psirt/FG-IR-19-013; https://fortiguard.com/psirt/FG-IR-19-013
CVE: CVE-2020-11610
Published: 2020-04-07
Description: An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://github.com/ofirdagan/cross-domain-local-storage; https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe; https://github.com/ofirdagan/cross-domain-local-storage
CVE: CVE-2020-11611
Published: 2020-04-07
Description: An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://github.com/ofirdagan/cross-domain-local-storage; https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Client; https://github.com/ofirdagan/cross-domain-local-storage
CVE: CVE-2020-11612
Published: 2020-04-07
Description: The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://github.com/netty/netty/compare/netty-4.1.45.Final...netty-4.1.46.Final; https://github.com/netty/netty/issues/6168; https://github.com/netty/netty/pull/9924
CVE: CVE-2020-6974
Published: 2020-04-07
Description: Honeywell Notifier Web Server (NWS) Version 3.50 is vulnerable to a path traversal attack, which allows an attacker to bypass access to restricted directories. Honeywell has released a firmware update to address the problem.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22, CWE-22
References: https://www.us-cert.gov/ics/advisories/icsa-20-051-03; https://www.us-cert.gov/ics/advisories/icsa-20-051-03
CVE: CVE-2020-11508
Published: 2020-04-07
Description: An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/; https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/
CVE: CVE-2020-11509
Published: 2020-04-07
Description: An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/; https://www.wordfence.com/blog/2020/04/critical-vulnerabilities-in-the-wp-lead-plus-x-wordpress-plugin/
CVE: CVE-2020-6647
Published: 2020-04-07
Description: An improper neutralization of input vulnerability in the dashboard of FortiADC may allow an authenticated attacker to perform a cross site scripting attack (XSS) via the name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://fortiguard.com/psirt/FG-IR-20-012; https://fortiguard.com/psirt/FG-IR-20-012
CVE: CVE-2020-9286
Published: 2020-04-07
Description: An improper authorization vulnerability in FortiADC may allow a remote authenticated user with low privileges to perform certain actions such as rebooting the system.
CVSS Score: 6.5 (MEDIUM)
References: https://fortiguard.com/psirt/FG-IR-20-013; https://fortiguard.com/psirt/FG-IR-20-013
CVE: CVE-2020-11619
Published: 2020-04-07
Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/FasterXML/jackson-databind/issues/2680; https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E; https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html
CVE: CVE-2020-11620
Published: 2020-04-07
Description: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/FasterXML/jackson-databind/issues/2682; https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E; https://lists.debian.org/debian-lts-announce/2020/04/msg00012.html
CVE: CVE-2020-10366
Published: 2020-04-08
Description: LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://sourceforge.net/p/logicaldoc/code/HEAD/tree/community/logicaldoc/trunk/ReleaseNotes.txt; https://www.coresecurity.com/advisories/logicaldoc-virtual-appliance-multiple-vulnerabilities; https://sourceforge.net/p/logicaldoc/code/HEAD/tree/community/logicaldoc/trunk/ReleaseNotes.txt
CVE: CVE-2020-11543
Published: 2020-04-08
Description: OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. This issue has been resolved in OpsRamp Gateway firmware version 7.0.0 where an administrator and a system user accounts are the only available user accounts for the gateway appliance.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://docs.opsramp.com/about/release-notes/summer-2020-update/#simplified-gateway-appliance-accounts; https://www.criticalstart.com/hard-coded-administrator-password-discovered-in-opsramp/; https://docs.opsramp.com/about/release-notes/summer-2020-update/#simplified-gateway-appliance-accounts
CVE: CVE-2020-11626
Published: 2020-04-08
Description: An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. Two Cross Side Scripting (XSS) vulnerabilities have been found in the Public Web and the Certificate/CRL download servlets.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.primekey.com/news/primekey-announcements; https://support.primekey.com/news/primekey-announcements
CVE: CVE-2020-11627
Published: 2020-04-08
Description: An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery (CSRF) issue has been found in the CA UI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://support.primekey.com/news/primekey-announcements; https://support.primekey.com/news/primekey-announcements
CVE: CVE-2020-11628
Published: 2020-04-08
Description: An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols (CMP, ACME, REST, etc.) through the system configuration. These restrictions can be bypassed by modifying the URI string from a client. (EJBCA's internal access control restrictions are still in place, and each respective protocol must be configured to allow for enrollment.)
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-863
References: https://support.primekey.com/news/posts/ejbca-security-advisory-protocol-access-control-bypass; https://support.primekey.com/news/posts/ejbca-security-advisory-protocol-access-control-bypass
CVE: CVE-2020-11629
Published: 2020-04-08
Description: An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to the CA UI could exploit this to upload malicious scripts to the server. (Risks associated with this issue alone are negligible unless a malicious user already has gained access to the CA UI through other means, as a trusted user is already trusted to upload scripts by virtue of having access to the validator.)
CVSS Score: 7.2 (HIGH)
CWE: CWE-522
References: https://support.primekey.com/news/primekey-announcements; https://support.primekey.com/news/primekey-announcements
CVE: CVE-2020-11630
Published: 2020-04-08
Description: An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes (connected via the Peers protocol) allows insecure objects to be deserialized.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://support.primekey.com/news/posts/ejbca-security-advisory-deserialization-bug; https://support.primekey.com/news/posts/ejbca-security-advisory-deserialization-bug
CVE: CVE-2020-11631
Published: 2020-04-08
Description: An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. (This is exploitable only when at least one accessible port lacks a requirement for client certificate authentication. These ports are 8442 or 8080 in a standard installation.)
CVSS Score: 6.5 (MEDIUM)
References: https://support.primekey.com/news/primekey-announcements; https://support.primekey.com/news/primekey-announcements
CVE: CVE-2019-15789
Published: 2020-04-08
Description: Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to the host by provisioning a privileged container. Fixed in MicroK8s 1.15.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://discuss.kubernetes.io/t/explicit-use-of-sudo-in-microk8s-cli/7605; https://github.com/ubuntu/microk8s/pull/590; https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15789.html
CVE: CVE-2020-10633
Published: 2020-04-08
Description: A non-persistent XSS (cross-site scripting) vulnerability exists in eWON Flexy and Cosy (all firmware versions prior to 14.1s0). An attacker could send a specially crafted URL to initiate a password change for the device. The target must introduce the credentials to the gateway before the attack can be successful.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.us-cert.gov/ics/advisories/icsa-20-098-03; https://www.us-cert.gov/ics/advisories/icsa-20-098-03
CVE: CVE-2020-5549
Published: 2020-04-08
Description: Cross-site request forgery (CSRF) vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier and Enterprise Ver. 2.0.1 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jvn.jp/en/jp/JVN89224521/index.html; https://www.plathome.co.jp/software/ipv6-enterprise-v2-0-2/; https://www.plathome.co.jp/software/ipv6-v2-0-2/
CVE: CVE-2020-5550
Published: 2020-04-08
Description: Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to impersonate a registered user and log in the management console, that may result in information alteration/disclosure via unspecified vectors.
CVSS Score: 8.1 (HIGH)
CWE: CWE-384
References: https://jvn.jp/en/jp/JVN89224521/index.html; https://www.plathome.co.jp/software/ipv6-enterprise-v2-0-2/; https://www.plathome.co.jp/software/ipv6-v2-0-2/
CVE: CVE-2017-18646
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. An attacker can bypass the password requirement for tablet user switching by folding the magnetic cover. The Samsung ID is SVE-2017-10602 (December 2017).
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2020-5735
Published: 2020-04-08
Description: Amcrest cameras and NVR are vulnerable to a stack-based buffer overflow over port 37777. An authenticated remote attacker can abuse this issue to crash the device and possibly execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-787
References: http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html; https://www.tenable.com/security/research/tra-2020-20; http://packetstormsecurity.com/files/157164/Amcrest-Dahua-NVR-Camera-IP2M-841-Denial-Of-Service.html
CVE: CVE-2020-5736
Published: 2020-04-08
Description: Amcrest cameras and NVR are vulnerable to a null pointer dereference over port 37777. An authenticated remote attacker can abuse this issue to crash the device.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476
References: https://www.tenable.com/security/research/tra-2020-20; https://www.tenable.com/security/research/tra-2020-20
CVE: CVE-2017-18643
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. There is information disclosure of the kbase_context address of a GPU memory node. The Samsung ID is SVE-2017-8907 (December 2017).
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18644
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with L(5.1), M(6.x), and N(7.x) software. There is a muic_set_reg_sel heap-based buffer overflow during the reading of MUIC register values. The Samsung ID is SVE-2017-10011 (December 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2017-18645
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) (Qualcomm chipsets) software. There is a panel_lpm sysfs stack-based buffer overflow. The Samsung ID is SVE-2017-9414 (December 2017).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21089
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with N(7.x) (MT6755/MT6757 Mediatek models) software. Bootloader has an integer overflow that leads to arbitrary code execution via the download offset control. The Samsung ID is SVE-2017-10732 (January 2018).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21090
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with software through 2017-11-03 (S.LSI modem chipsets). The Exynos modem chipset has a baseband buffer overflow. The Samsung ID is SVE-2017-10745 (January 2018).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21091
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. Telecom has a System Crash via abnormal exception handling. The Samsung ID is SVE-2017-10906 (January 2018).
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb
CVE: CVE-2018-21092
Published: 2020-04-08
Description: An issue was discovered on Samsung mobile devices with M(6.x) and N(7.x) software. A crafted AT command may be sent by the DeviceTest application via an NFC tag. The Samsung ID is SVE-2017-10885 (January 2018).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://security.samsungmobile.com/securityUpdate.smsb; https://security.samsungmobile.com/securityUpdate.smsb