deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-0083
Published: 2020-03-10
Description: In setRequirePmfInternal of sta_network.cpp, there is a possible default value being improperly applied due to a logic error. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142797954
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-7579
Published: 2020-03-10
Description: A vulnerability has been identified in Spectrum Power™ 5 (All versions < v5.50 HF02). The web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. If deployed according to recommended system configuration, Siemens consideres the environmental vector as CR:L/IR:M/AR:H/MAV:A (4.1).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://cert-portal.siemens.com/productcert/pdf/ssa-938930.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-938930.pdf
CVE: CVE-2020-9044
Published: 2020-03-10
Description: XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611, CWE-611
References: https://www.johnsoncontrols.com/cyber-solutions/security-advisories; https://www.us-cert.gov/ics/advisories/icsa-20-070-05; https://www.johnsoncontrols.com/cyber-solutions/security-advisories
CVE: CVE-2019-11938
Published: 2020-03-10
Description: Java Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2019.12.09.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/facebook/fbthrift/commit/08c2d412adb214c40bb03be7587057b25d053030; https://github.com/facebook/fbthrift/commit/71c97ffdcb61cccf1f8267774e873e21ebd3ebd3; https://www.facebook.com/security/advisories/cve-2019-11938
CVE: CVE-2019-3553
Published: 2020-03-10
Description: C++ Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.02.03.00.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770, CWE-770
References: https://github.com/facebook/fbthrift/commit/3f156207e8a6583d88999487e954320dc18955e6; https://github.com/facebook/fbthrift/commit/c9a903e5902834e95bbd4ab0e9fa53ba0189f351; https://www.facebook.com/security/advisories/cve-2019-3553
CVE: CVE-2020-0045
Published: 2020-03-10
Description: In StatsService::command of StatsService.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141243101
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0046
Published: 2020-03-10
Description: In DrmPlugin::releaseSecureStops of DrmPlugin.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-137284652
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0047
Published: 2020-03-10
Description: In setMasterMute of AudioService.java, there is a missing permission check. This could lead to local silencing of audio with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141622311
CVSS Score: 3.3 (LOW)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0048
Published: 2020-03-10
Description: In onTransact of IAudioFlinger.cpp, there is a possible stack information leak due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-139417189
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0049
Published: 2020-03-10
Description: In onReadBuffer() of StreamingSource.cpp, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-140177694
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0050
Published: 2020-03-10
Description: In nfa_hciu_send_msg of nfa_hci_utils.cc, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege in the NFC server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-124521372
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20, CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0051
Published: 2020-03-10
Description: In onCreate of SettingsHomepageActivity, there is a possible tapjacking attack. This could lead to local escalation of privilege in Settings with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-138442483
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0052
Published: 2020-03-10
Description: In smsSelected of AnswerFragment.java, there is a way to send an SMS from the lock screen due to a permissions bypass. This could lead to local escalation of privilege on the lock screen with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-137102479
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-306
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0053
Published: 2020-03-10
Description: In convertHidlNanDataPathInitiatorRequestToLegacy, and convertHidlNanDataPathIndicationResponseToLegacy of hidl_struct_util.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143789898
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0054
Published: 2020-03-10
Description: In WifiNetworkSuggestionsManager of WifiNetworkSuggestionsManager.java, there is a possible permission revocation due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146642727
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0055
Published: 2020-03-10
Description: In l2c_link_process_num_completed_pkts of l2c_link.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141617601
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00505.html; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0056
Published: 2020-03-10
Description: In btu_hcif_connection_comp_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141619686
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0057
Published: 2020-03-10
Description: In btm_process_inq_results of btm_inq.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141620271
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0062
Published: 2020-03-10
Description: In Euicc, there is a possible information disclosure due to an included test Certificate. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143232031
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0063
Published: 2020-03-10
Description: In SurfaceFlinger, it is possible to override UI confirmation screen protected by the TEE. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-143128911
CVSS Score: 7.3 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0066
Published: 2020-03-10
Description: In the netlink driver, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-65025077
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0084
Published: 2020-03-10
Description: In several functions of NotificationManagerService.java, there are missing permission checks. This could lead to local escalation of privilege by creating fake system notifications with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143339775
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0085
Published: 2020-03-10
Description: In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege to activate tethering with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-134487438
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-0087
Published: 2020-03-10
Description: In getProcessPss of ActivityManagerService.java, there is a possible side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-127989044
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://source.android.com/security/bulletin/pixel/2020-03-01; https://source.android.com/security/bulletin/pixel/2020-03-01
CVE: CVE-2020-10372
Published: 2020-03-10
Description: Ramp AltitudeCDN Altimeter before 2.4.0 allows authenticated Stored XSS via the vdms/ipmapping.jsp location field to the dms/rest/services/datastore/createOrEditValueForKey URI.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://labs.f-secure.com/advisories/ramp-altimeter-stored-xss/; https://labs.f-secure.com/advisories/ramp-altimeter-stored-xss/
CVE: CVE-2020-6178
Published: 2020-03-10
Description: SAP Enable Now, before version 1911, sends the Session ID cookie value in URL. This might be stolen from the browser history or log files, leading to Information Disclosure.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: https://launchpad.support.sap.com/#/notes/2880664; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2880664
CVE: CVE-2020-6196
Published: 2020-03-10
Description: SAP BusinessObjects Mobile (MobileBIService), version 4.2, allows an attacker to generate multiple requests, using which he can block all the threads resulting in a Denial of Service.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2826782; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2826782
CVE: CVE-2020-6197
Published: 2020-03-10
Description: SAP Enable Now, before version 1908, does not invalidate session tokens in a timely manner. The Insufficient Session Expiration may allow attackers with local access, for instance, to still download the portables.
CVSS Score: 3.3 (LOW)
CWE: CWE-613
References: https://launchpad.support.sap.com/#/notes/2845363; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2845363
CVE: CVE-2020-6198
Published: 2020-03-10
Description: SAP Solution Manager (Diagnostics Agent), version 720, allows unencrypted connections from unauthenticated sources. This allows an attacker to control all remote functions on the Agent due to Missing Authentication Check.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-319
References: https://launchpad.support.sap.com/#/notes/2845377; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2845377
CVE: CVE-2020-6199
Published: 2020-03-10
Description: The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to Missing Authorization Check.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2871167; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2871167
CVE: CVE-2020-6200
Published: 2020-03-10
Description: The SAP Commerce (SmartEdit Extension), versions- 6.6, 6.7, 1808, 1811, is vulnerable to client-side angularjs template injection, a variant of Cross-Site-Scripting (XSS) that exploits the templating facilities of the angular framework.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2876413; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2876413
CVE: CVE-2020-6201
Published: 2020-03-10
Description: The SAP Commerce (Testweb Extension), versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2876813; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2876813
CVE: CVE-2020-6202
Published: 2020-03-10
Description: SAP NetWeaver Application Server Java (User Management Engine), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; does not sufficiently validate the LDAP data source configuration XML document accepted from an untrusted source, leading to Missing XML Validation.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: https://launchpad.support.sap.com/#/notes/2847787; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2847787
CVE: CVE-2020-6203
Published: 2020-03-10
Description: SAP NetWeaver UDDI Server (Services Registry), versions- 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50; allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs, leading to Path Traversal.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://launchpad.support.sap.com/#/notes/2806198; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2806198
CVE: CVE-2020-6204
Published: 2020-03-10
Description: The selection query in SAP Treasury and Risk Management (Transaction Management) (EA-FINSERV?versions 600, 603, 604, 605, 606, 616, 617, 618, 800 and S4CORE versions 101, 102, 103, 104) returns more records than it should be when selecting and displaying the contract number, leading to Missing Authorization Check.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2841874; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2841874
CVE: CVE-2020-6205
Published: 2020-03-10
Description: SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing an unauthenticated attacker to non-permanently deface or modify displayed content and/or steal authentication information of the user and/or impersonate the user and access all information with the same rights as the target user, leading to Reflected Cross Site Scripting Vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2884910; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2884910
CVE: CVE-2020-6206
Published: 2020-03-10
Description: SAP Cloud Platform Integration for Data Services, version 1.0, allows user inputs to be reflected as error or warning massages. This could mislead the victim to follow malicious instructions inserted by external attackers, leading to Cross Site Request Forgery.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://launchpad.support.sap.com/#/notes/2859004; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2859004
CVE: CVE-2020-6207
Published: 2020-03-10
Description: SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-306
References: http://packetstormsecurity.com/files/161993/SAP-Solution-Manager-7.2-Remote-Command-Execution.html; http://packetstormsecurity.com/files/162083/SAP-SMD-Agent-Unauthenticated-Remote-Code-Execution.html; http://packetstormsecurity.com/files/163168/SAP-Solution-Manager-7.20-Missing-Authorization.html
CVE: CVE-2020-6208
Published: 2020-03-10
Description: SAP Business Objects Business Intelligence Platform (Crystal Reports), versions- 4.1, 4.2, allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application, leading to Remote Code Execution. Although the mode of attack is only Local, multiple applications can be impacted as a result of the vulnerability.
CVSS Score: 8.2 (HIGH)
CWE: CWE-416
References: https://launchpad.support.sap.com/#/notes/2861301; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://www.zerodayinitiative.com/advisories/ZDI-20-291/
CVE: CVE-2020-6209
Published: 2020-03-10
Description: SAP Disclosure Management, version 10.1, does not perform necessary authorization checks for an authenticated user, allowing access to administration accounts by a user with no roles, leading to Missing Authorization Check.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://launchpad.support.sap.com/#/notes/2858044; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2858044
CVE: CVE-2020-6210
Published: 2020-03-10
Description: SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, leading to reflected Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://launchpad.support.sap.com/#/notes/2864462; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=540935305; https://launchpad.support.sap.com/#/notes/2864462
CVE: CVE-2019-16107
Published: 2020-03-11
Description: Missing form token validation in phpBB 3.2.7 allows CSRF in deleting post attachments.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://www.phpbb.com/community/viewforum.php?f=14; https://www.phpbb.com/community/viewtopic.php?t=2523271; https://www.phpbb.com/community/viewforum.php?f=14