deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-25744
Published: 2020-09-18
Description: SaferVPN before 5.0.3.3 on Windows could allow low-privileged users to create or overwrite arbitrary files, which could cause a denial of service (DoS) condition, because a symlink from %LOCALAPPDATA%\SaferVPN\Log is followed.
CVSS Score: 8.1 (HIGH)
CWE: CWE-59
References: https://medium.com/%40thebinary0x1/safervpn-for-windows-arbitrary-file-overwrite-dos-bdc88fdb5ead; https://www.youtube.com/watch?v=0QdRJdA_aos; https://medium.com/%40thebinary0x1/safervpn-for-windows-arbitrary-file-overwrite-dos-bdc88fdb5ead
CVE: CVE-2020-25750
Published: 2020-09-18
Description: An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/DevGroup-ru/dotplant2/issues/400; https://github.com/DevGroup-ru/dotplant2/issues/400
CVE: CVE-2020-25751
Published: 2020-09-18
Description: The paGO Commerce plugin 2.5.9.0 for Joomla! allows SQL Injection via the administrator/index.php?option=com_pago&view=comments filter_published parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://geekwire.eu/2020/09/14/joomla-pago-commerce-2-5-9-0-sql-injection-authenticated/; https://www.exploit-db.com/exploits/48811; https://geekwire.eu/2020/09/14/joomla-pago-commerce-2-5-9-0-sql-injection-authenticated/
CVE: CVE-2020-25756
Published: 2020-09-18
Description: A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/cesanta/mongoose/issues/1135; https://github.com/cesanta/mongoose/issues/1135
CVE: CVE-2020-5605
Published: 2020-09-18
Description: Directory traversal vulnerability in WHR-G54S firmware 1.43 and earlier allows an attacker to access sensitive information such as setting values via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: https://jvn.jp/en/jp/JVN09166495/index.html; https://www.buffalo.jp/news/detail/20200911-01.html; https://jvn.jp/en/jp/JVN09166495/index.html
CVE: CVE-2020-5606
Published: 2020-09-18
Description: Cross-site scripting vulnerability in WHR-G54S firmware 1.43 and earlier allows remote attackers to inject arbitrary script via a specially crafted page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://jvn.jp/en/jp/JVN09166495/index.html; https://www.buffalo.jp/news/detail/20200911-01.html; https://jvn.jp/en/jp/JVN09166495/index.html
CVE: CVE-2020-5628
Published: 2020-09-18
Description: UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via the vulnerable App. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN31864411/index.html; https://jvn.jp/en/jp/JVN31864411/index.html
CVE: CVE-2020-5629
Published: 2020-09-18
Description: UNIQLO App for Android versions 7.3.3 and earlier allows remote attackers to lead a user to access an arbitrary website via a malicious App created by the third party. As a result, if the access destination is a malicious website, the user may fall victim to the social engineering attack.
CVSS Score: 6.5 (MEDIUM)
References: https://jvn.jp/en/jp/JVN31864411/index.html; https://jvn.jp/en/jp/JVN31864411/index.html
CVE: CVE-2020-15767
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute, which allows an attacker with the ability to MITM plain HTTP requests to obtain it, if the user mistakenly uses a HTTP instead of HTTPS address to access the server. This cookie value could then be used to perform CSRF.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-311
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15767; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15768
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle Enterprise allows remote attackers to obtain authentication cookies, if they are able to discover a separate XSS vulnerability. This potentially allows an attacker to impersonate another user. Gradle Enterprise affected application request paths:/info/headers, /cache-info/headers, /admin-info/headers, /distribution-broker-info/headers. Gradle Enterprise Build Cache Node affected application request paths:/cache-node-info/headers.
CVSS Score: 7.5 (HIGH)
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15768; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15769
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15769; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15770
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-out after excessive failed logins.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-307
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15770; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15771
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows remote attacker to bypass CSRF mitigation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-311
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15771; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15772
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata file can be uploaded by an administrator. The server side processing of this file dereferences XML External Entities (XXE), allowing a remote attacker with administrative access to perform server side request forgery.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-611, CWE-918
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15772; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15774
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-613
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15774; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15775
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously.
CVSS Score: 7.5 (HIGH)
CWE: CWE-922
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15775; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15776
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token, allowing them to perform cross-site request forgery.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://cwe.mitre.org/data/definitions/1004.html; https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15776
CVE: CVE-2020-0089
Published: 2020-09-18
Description: In the audio server, there is a missing permission check. This could lead to local escalation of privilege regarding audio settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-137015603
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0262
Published: 2020-09-18
Description: In WiFi tethering, there is a possible attacker controlled intent due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156353008
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0318
Published: 2020-09-18
Description: In the System UI, there is a possible system crash due to an uncaught exception. This could lead to local permanent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-33646131
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0354
Published: 2020-09-18
Description: In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-143604331
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-15773
Published: 2020-09-18
Description: An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker can access data as a user (for the duration of the browser session) after previously explicitly authenticating with the API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-346
References: https://github.com/gradle/gradle/security/advisories; https://security.gradle.com/advisory/CVE-2020-15773; https://github.com/gradle/gradle/security/advisories
CVE: CVE-2020-15958
Published: 2020-09-18
Description: An issue was discovered in 1CRM System through 8.6.7. An insecure direct object reference to internally stored files allows a remote attacker to access various sensitive information via an unauthenticated request with a predictable URL.
CVSS Score: 8.6 (HIGH)
CWE: CWE-639
References: http://packetstormsecurity.com/files/159193/1CRM-8.6.7-Insecure-Direct-Object-Reference.html; http://seclists.org/fulldisclosure/2020/Sep/31; https://1crm.com/documentation/
CVE: CVE-2020-5975
Published: 2020-09-18
Description: NVIDIA GeForce NOW, versions prior to 2.0.23 on Windows and macOS, contains a vulnerability in the desktop application software that includes sensitive information as part of a URL, which may lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5052; https://nvidia.custhelp.com/app/answers/detail/a_id/5052
CVE: CVE-2020-5976
Published: 2020-09-18
Description: NVIDIA GeForce NOW, versions prior to 2.0.23 (Windows, macOS) and versions prior to 5.31 (Android, Shield TV), contains a vulnerability in the application software where the network test component transmits sensitive information insecurely, which may lead to information disclosure.
CVSS Score: 7.5 (HIGH)
References: https://nvidia.custhelp.com/app/answers/detail/a_id/5052; https://nvidia.custhelp.com/app/answers/detail/a_id/5052
CVE: CVE-2020-7358
Published: 2020-09-18
Description: In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an installation and any arbitrary code executable using the same file name.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://help.rapid7.com/appspider/release-notes/index.html?pid=7.2.126; https://help.rapid7.com/appspider/release-notes/index.html?pid=7.2.126
CVE: CVE-2020-9739
Published: 2020-09-18
Description: Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-57.html; https://helpx.adobe.com/security/products/media-encoder/apsb20-57.html
CVE: CVE-2020-9744
Published: 2020-09-18
Description: Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-57.html; https://helpx.adobe.com/security/products/media-encoder/apsb20-57.html
CVE: CVE-2020-9745
Published: 2020-09-18
Description: Adobe Media Encoder version 14.3.2 (and earlier versions) has an out-of-bounds read vulnerability that could be exploited to read past the end of an allocated buffer, possibly resulting in a crash or disclosure of sensitive information from other memory locations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://helpx.adobe.com/security/products/media-encoder/apsb20-57.html; https://helpx.adobe.com/security/products/media-encoder/apsb20-57.html
CVE: CVE-2020-0263
Published: 2020-09-18
Description: In the Accessibility service, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154913130
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0265
Published: 2020-09-18
Description: In Telephony, there are possible leaks of sensitive data due to missing permission checks. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150155839
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0268
Published: 2020-09-18
Description: In NFC, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-148294643
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0269
Published: 2020-09-18
Description: In Android Auto Settings, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151645626
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0271
Published: 2020-09-18
Description: In the Settings app, there is an insecure default value. This could lead to local escalation of privilege and tapjacking with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-144507081
CVSS Score: 7.3 (HIGH)
CWE: CWE-1188
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0272
Published: 2020-09-18
Description: In libhwbinder, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges required. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-130166487
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0273
Published: 2020-09-18
Description: In hwservicemanager, there is a possible out of bounds write due to freeing a wild pointer. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155646800
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0276
Published: 2020-09-18
Description: In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156253586
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0281
Published: 2020-09-18
Description: In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure. System execution privileges, a Firmware compromise, and User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-137857778
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0282
Published: 2020-09-18
Description: In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure. System execution privileges, a Firmware compromise, and User interaction are needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-144506224
CVSS Score: 4.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0284
Published: 2020-09-18
Description: In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156253784
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0285
Published: 2020-09-18
Description: In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156253479
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0286
Published: 2020-09-18
Description: In Bluetooth AVRCP, there is a possible leak of audio metadata due to residual data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150214479
CVSS Score: 7.5 (HIGH)
CWE: CWE-459
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0291
Published: 2020-09-18
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges and a compromised Firmware needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-146032016
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0292
Published: 2020-09-18
Description: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges and a compromised Firmware needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-110107252
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0294
Published: 2020-09-18
Description: In bindWallpaperComponentLocked of WallpaperManagerService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.0 Android-8.1 Android-9Android ID: A-154915372
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2020-12-01; https://source.android.com/security/bulletin/2020-12-01
CVE: CVE-2020-0295
Published: 2020-09-18
Description: In Telecom, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155650969
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11