deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-0387
Published: 2020-09-17
Description: In manifest files of the SmartSpace package, there is a possible tapjacking vector due to a missing permission check. This could lead to local escalation of privilege and account hijacking with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-156046804
CVSS Score: 7.8 (HIGH)
CWE: CWE-862, CWE-1021
References: https://source.android.com/security/bulletin/pixel/2020-09-01; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0403
Published: 2020-09-17
Description: In the FPC TrustZone fingerprint App, there is a possible invalid command handler due to an exposed test feature. This could lead to local escalation of privilege in the TEE, with System execution privileges required. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-131252923
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-269
References: https://source.android.com/security/bulletin/pixel/2020-09-01; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0427
Published: 2020-09-17
Description: In create_pinctrl of core.c, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-140550171
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html; http://packetstormsecurity.com/files/161229/Kernel-Live-Patch-Security-Notice-LSN-0074-1.html
CVE: CVE-2020-0428
Published: 2020-09-17
Description: In CamX code, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges required. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-123999783
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-416
References: https://source.android.com/security/bulletin/pixel/2020-09-01; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0429
Published: 2020-09-17
Description: In l2tp_session_delete and related functions of l2tp_core.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152735806
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-09-01; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0430
Published: 2020-09-17
Description: In skb_headlen of /include/linux/skbuff.h, there is a possible out of bounds read due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-153881554
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2020-09-01; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0431
Published: 2020-09-17
Description: In kbd_keycode of keyboard.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-144161459
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0432
Published: 2020-09-17
Description: In skb_to_mamac of networking.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143560807
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0433
Published: 2020-09-17
Description: In blk_mq_queue_tag_busy_iter of blk-mq-tag.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-151939299
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-667
References: https://source.android.com/security/bulletin/pixel/2020-09-01; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0434
Published: 2020-09-17
Description: In Pixel's use of the Catpipe library, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-150730508
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-09-01; https://source.android.com/security/bulletin/pixel/2020-09-01
CVE: CVE-2020-0435
Published: 2020-09-17
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-14615. Reason: This candidate is a duplicate of CVE-2018-14615. Notes: All CVE users should reference CVE-2018-14615 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2020-24750
Published: 2020-09-17
Description: FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://github.com/FasterXML/jackson-databind/commit/ad5a630174f08d279504bc51ebba8772fd71b86b; https://github.com/FasterXML/jackson-databind/issues/2798; https://lists.debian.org/debian-lts-announce/2021/04/msg00025.html
CVE: CVE-2020-25215
Published: 2020-09-17
Description: yWorks yEd Desktop before 3.20.1 allows XXE attacks via an XML or GraphML document.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-611
References: https://www.yworks.com/products/yed/download; https://zigrin.com/advisories/yworks-yed-graph-editor-xml-external-entity-injection/; https://www.yworks.com/products/yed/download
CVE: CVE-2020-25216
Published: 2020-09-17
Description: yWorks yEd Desktop before 3.20.1 allows code execution via an XSL Transformation when using an XML file in conjunction with a custom stylesheet.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-91
References: https://www.yworks.com/products/yed/download; https://zigrin.com/advisories/yworks-yed-graph-editor-xslt-remote-code-execution-in-xml/; https://www.yworks.com/products/yed/download
CVE: CVE-2020-13260
Published: 2020-09-17
Description: A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as the static key file in Configuration-Services-Security-OpenVPN-Static Keys. This payload will execute each time a user opens an affected web page. This could be exploited in conjunction with CVE-2020-13259.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-434
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/48807; https://www.rad.com/products/secflow-1v-IIoT-Gateway#panels-ipe-paneid-143837
CVE: CVE-2020-15182
Published: 2020-09-17
Description: The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially crafted webpage. An administrator must be logged in for exploitation to be possible. This issue is fixed in SOY Inquiry version 2.0.0.4 and included in SOY CMS 3.0.2.328.
CVSS Score: 8.4 (HIGH)
CWE: CWE-22, CWE-352
References: https://github.com/inunosinsi/soycms/pull/15; https://github.com/inunosinsi/soycms/security/advisories/GHSA-j2qw-747j-mfv4; https://youtu.be/ffvKH3gwyRE
CVE: CVE-2020-15183
Published: 2020-09-17
Description: SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.
CVSS Score: 8.4 (HIGH)
CWE: CWE-79
References: https://github.com/inunosinsi/soycms/commit/045a222016f99b56557b0d8f39bbfc653d2c4707; https://github.com/inunosinsi/soycms/security/advisories/GHSA-33q6-4xmp-2f48; https://youtu.be/uAMAwH35ups
CVE: CVE-2020-0125
Published: 2020-09-17
Description: In mediadrm, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-137282168
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0130
Published: 2020-09-17
Description: In screencap, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege in a system process with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-123230379
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-77
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0264
Published: 2020-09-17
Description: In libstagefright, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-116718596
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0266
Published: 2020-09-17
Description: In factory reset protection, there is a possible FRP bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-111086459
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0267
Published: 2020-09-17
Description: In WindowManager, there is a possible launch of an unexpected app due to a confused deputy. This could lead to local escalation of privilege due to launching a malicious app instead of the one the user intended, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-139128211
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0270
Published: 2020-09-17
Description: In tremolo, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-145790628
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0274
Published: 2020-09-17
Description: In the OMX parser, there is a possible information disclosure due to a returned raw pointer. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-120781925
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0275
Published: 2020-09-17
Description: In MediaProvider, there is a possible way to access ContentResolver and MediaStore entries the app shouldn't have access to due to a permissions bypass. This could lead to local escalation of privilege, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150507736
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0277
Published: 2020-09-17
Description: In NetworkPolicyManagerService, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing a malicious app to modify the device's data plan with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-148627993
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0279
Published: 2020-09-17
Description: In the AAC parser, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-131430997
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; http://www.openwall.com/lists/oss-security/2025/08/13/9; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0287
Published: 2020-09-17
Description: In libmkvextractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-141860394
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0288
Published: 2020-09-17
Description: In PackageManager, there is a missing permission check. This could lead to local information disclosure across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153995991
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0289
Published: 2020-09-17
Description: In PackageManager, there is a missing permission check. This could lead to local information disclosure across users with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153996872
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0290
Published: 2020-09-17
Description: In PackageManager, there is a missing permission check. This could lead to local information disclosure across users with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153996866
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0293
Published: 2020-09-17
Description: In Java network APIs, there is possible access to sensitive network state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation in Android versions: Android-11, Android ID: A-141455849
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://www.usenix.org/conference/usenixsecurity19/presentation/reardon; https://www.usenix.org/system/files/sec19-reardon.pdf
CVE: CVE-2020-0296
Published: 2020-09-17
Description: In ADB server and USB server, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153356209
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0297
Published: 2020-09-17
Description: In devicepolicy service, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155183624
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0301
Published: 2020-09-17
Description: In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124940460
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0303
Published: 2020-09-17
Description: In the Media extractor, there is a possible use after free due to improper locking. This could lead to remote code execution in the media extractor with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-148223229
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-667
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0306
Published: 2020-09-17
Description: In LLVM, there is a possible ineffective stack cookie placement due to stack frame double reservation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-139666480
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0308
Published: 2020-09-17
Description: In Window Manager, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153654357
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0312
Published: 2020-09-17
Description: In Battery Saver, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153879099
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0314
Published: 2020-09-17
Description: In AudioService, there are missing permission checks. This could lead to local information disclosure of audio configuration with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154934920
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0317
Published: 2020-09-17
Description: In UsageStatsManager, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-119671929
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0320
Published: 2020-09-17
Description: In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-129282427
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0321
Published: 2020-09-17
Description: In the mp3 extractor, there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155171907
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-908
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0322
Published: 2020-09-17
Description: In apexd, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-147002540
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0323
Published: 2020-09-17
Description: In libavb, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-146516087
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11