deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15254
Published: 2020-10-16
Description: Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4.
CVSS Score: 8.1 (HIGH)
CWE: CWE-119, CWE-401
References: https://github.com/RustSec/advisory-db/pull/425; https://github.com/crossbeam-rs/crossbeam/issues/539; https://github.com/crossbeam-rs/crossbeam/pull/533
CVE: CVE-2020-15255
Published: 2020-10-16
Description: In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.
CVSS Score: 8.7 (HIGH)
CWE: CWE-74, CWE-1236
References: http://packetstormsecurity.com/files/159996/Anuko-Time-Tracker-1.19.23.5325-CSV-Injection.html; https://github.com/anuko/timetracker/commit/d[PII_REDACTED]495f318c9d0294ffd28acaaeae42f; https://github.com/anuko/timetracker/security/advisories/GHSA-prjf-9mgh-8fpv
CVE: CVE-2020-15258
Published: 2020-10-16
Description: In Wire before 3.20.x, `shell.openExternal` was used without checking the URL. This vulnerability allows an attacker to execute code on the victims machine by sending messages containing links with arbitrary protocols. The victim has to interact with the link and sees the URL that is opened. The issue was patched by implementing a helper function which checks if the URL's protocol is common. If it is common, the URL will be opened externally. If not, the URL will not be opened and a warning appears for the user informing them that a probably insecure URL was blocked from being executed. The issue is patched in Wire 3.20.x. More technical details about exploitation are available in the linked advisory.
CVSS Score: 8.0 (HIGH)
CWE: CWE-20
References: https://benjamin-altpeter.de/shell-openexternal-dangers/; https://github.com/wireapp/wire-desktop/commit/b3705fffa75a03f055530f55a754face5ac0623b; https://github.com/wireapp/wire-desktop/security/advisories/GHSA-5gpx-9976-ggpm
CVE: CVE-2020-4254
Published: 2020-10-16
Description: IBM Security Guardium Big Data Intelligence 1.0 (SonarG) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 175560.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/175560; https://www.ibm.com/support/pages/node/6348664; https://exchange.xforce.ibmcloud.com/vulnerabilities/175560
CVE: CVE-2020-4636
Published: 2020-10-16
Description: IBM Resilient OnPrem 38.2 could allow a privileged user to inject malicious commands through Python3 scripting. IBM X-Force ID: 185503.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/185503; https://www.ibm.com/support/pages/node/6348694; https://exchange.xforce.ibmcloud.com/vulnerabilities/185503
CVE: CVE-2020-9799
Published: 2020-10-16
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT211289; https://support.apple.com/HT211289
CVE: CVE-2020-9862
Published: 2020-10-16
Description: A command injection issue existed in Web Inspector. This issue was addressed with improved escaping. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Copying a URL from Web Inspector may lead to command injection.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-116
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9864
Published: 2020-10-16
Description: A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.6. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/HT211289; https://support.apple.com/HT211289
CVE: CVE-2020-9865
Published: 2020-10-16
Description: A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to break out of its sandbox.
CVSS Score: 8.6 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9870
Published: 2020-10-16
Description: A logic issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. An attacker with memory write capability may be able to bypass pointer authentication codes and run arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9878
Published: 2020-10-16
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted USD file may lead to unexpected application termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211291
CVE: CVE-2020-9884
Published: 2020-10-16
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211289; https://support.apple.com/HT211289
CVE: CVE-2020-9885
Published: 2020-10-16
Description: An issue existed in the handling of iMessage tapbacks. The issue was resolved with additional verification. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A user that is removed from an iMessage group could rejoin the group.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-345
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9888
Published: 2020-10-16
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9889
Published: 2020-10-16
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9890
Published: 2020-10-16
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9891
Published: 2020-10-16
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. Processing a maliciously crafted audio file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9893
Published: 2020-10-16
Description: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9894
Published: 2020-10-16
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9895
Published: 2020-10-16
Description: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9903
Published: 2020-10-16
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. A malicious attacker may cause Safari to suggest a password for the wrong domain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: https://support.apple.com/HT211288; https://support.apple.com/HT211292; https://support.apple.com/HT211288
CVE: CVE-2020-9907
Published: 2020-10-16
Description: A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211288
CVE: CVE-2020-9909
Published: 2020-10-16
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9910
Published: 2020-10-16
Description: Multiple issues were addressed with improved logic. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication.
CVSS Score: 8.8 (HIGH)
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9911
Published: 2020-10-16
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, Safari 13.1.2. An issue in Safari Reader mode may allow a remote attacker to bypass the Same Origin Policy.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT211288; https://support.apple.com/HT211292; https://support.apple.com/HT211288
CVE: CVE-2020-9912
Published: 2020-10-16
Description: A logic issue was addressed with improved restrictions. This issue is fixed in Safari 13.1.2. A malicious attacker may be able to change the origin of a frame for a download in Safari Reader mode.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/HT211292; https://support.apple.com/HT211292
CVE: CVE-2020-9913
Published: 2020-10-16
Description: This issue was addressed with improved data protection. This issue is fixed in macOS Catalina 10.15.6. A local user may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT211289; https://support.apple.com/HT211289
CVE: CVE-2020-9914
Published: 2020-10-16
Description: An input validation issue existed in Bluetooth. This issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An attacker in a privileged network position may be able to perform denial of service attack using malformed Bluetooth packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211288
CVE: CVE-2020-9915
Published: 2020-10-16
Description: An access issue existed in Content Security Policy. This issue was addressed with improved access restrictions. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9916
Published: 2020-10-16
Description: A URL Unicode encoding issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A malicious attacker may be able to conceal the destination of a URL.
CVSS Score: 5.3 (MEDIUM)
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9917
Published: 2020-10-16
Description: This issue was addressed with improved checks. This issue is fixed in iOS 13.6 and iPadOS 13.6. A remote attacker may be able to cause a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/HT211288; https://support.apple.com/HT211288
CVE: CVE-2020-9918
Published: 2020-10-16
Description: An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9923
Published: 2020-10-16
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.6 and iPadOS 13.6, watchOS 6.2.8. A malicious application may be able to execute arbitrary code with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211288; https://support.apple.com/HT211291; https://support.apple.com/HT211288
CVE: CVE-2020-9925
Published: 2020-10-16
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9931
Published: 2020-10-16
Description: A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6. A remote attacker may cause an unexpected application termination.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT211288; https://support.apple.com/HT211288
CVE: CVE-2020-9933
Published: 2020-10-16
Description: An authorization issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8. A malicious application may be able to read sensitive location information.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/HT211288; https://support.apple.com/HT211290; https://support.apple.com/HT211291
CVE: CVE-2020-9934
Published: 2020-10-16
Description: An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211288
CVE: CVE-2020-9936
Published: 2020-10-16
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Processing a maliciously crafted image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT211288; https://support.apple.com/HT211289; https://support.apple.com/HT211290
CVE: CVE-2020-9946
Published: 2020-10-16
Description: This issue was addressed with improved checks. This issue is fixed in iOS 14.0 and iPadOS 14.0, watchOS 7.0. The screen lock may not engage after the specified time period.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-667
References: http://seclists.org/fulldisclosure/2020/Nov/20; http://seclists.org/fulldisclosure/2020/Nov/22; https://support.apple.com/HT211844
CVE: CVE-2020-9948
Published: 2020-10-16
Description: A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843
References: http://seclists.org/fulldisclosure/2020/Nov/18; http://www.openwall.com/lists/oss-security/2020/11/23/3; https://security.gentoo.org/glsa/202012-10
CVE: CVE-2020-9951
Published: 2020-10-16
Description: A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://seclists.org/fulldisclosure/2020/Nov/18; http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-9952
Published: 2020-10-16
Description: An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: http://seclists.org/fulldisclosure/2020/Nov/18; http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-9958
Published: 2020-10-16
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.0 and iPadOS 14.0. An application may be able to cause unexpected system termination or write kernel memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2020/Nov/20; https://support.apple.com/HT211850; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-9959
Published: 2020-10-16
Description: A lock screen issue allowed access to messages on a locked device. This issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0. A person with physical access to an iOS device may be able to view notification contents from the lockscreen.
CVSS Score: 2.4 (LOW)
CWE: CWE-667
References: http://seclists.org/fulldisclosure/2020/Nov/20; https://support.apple.com/HT211850; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-9964
Published: 2020-10-16
Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 14.0 and iPadOS 14.0. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: http://seclists.org/fulldisclosure/2020/Nov/20; https://support.apple.com/HT211850; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-9968
Published: 2020-10-16
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.0 and iPadOS 14.0, macOS Catalina 10.15.7, tvOS 14.0, watchOS 7.0. A malicious application may be able to access restricted files.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20; http://seclists.org/fulldisclosure/2020/Nov/21
CVE: CVE-2020-9976
Published: 2020-10-16
Description: A logic issue was addressed with improved state management. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0. A malicious application may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20; http://seclists.org/fulldisclosure/2020/Nov/22
CVE: CVE-2020-9983
Published: 2020-10-16
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 14.0. Processing maliciously crafted web content may lead to code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2020/Nov/18; http://seclists.org/fulldisclosure/2020/Nov/19; http://seclists.org/fulldisclosure/2020/Nov/20
CVE: CVE-2020-9992
Published: 2020-10-16
Description: This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2020/Nov/20; https://support.apple.com/HT211848; https://support.apple.com/HT211850
CVE: CVE-2020-26182
Published: 2020-10-16
Description: Dell EMC NetWorker versions prior to 19.3.0.2 contain an incorrect privilege assignment vulnerability. A non-LDAP remote user with low privileges may exploit this vulnerability to perform 'saveset' related operations in an unintended manner. The vulnerability is not exploitable by users authenticated via LDAP.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-266, CWE-552
References: https://www.dell.com/support/security/en-us/details/546616/DSA-2020-229-Dell-EMC-NetWorker-Multiple-Security-Vulnerabilities; https://www.dell.com/support/security/en-us/details/546616/DSA-2020-229-Dell-EMC-NetWorker-Multiple-Security-Vulnerabilities