deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-25282
Published: 2020-09-11
Description: An issue was discovered on LG mobile devices with Android OS 10 software. The lguicc software (for the LG Universal Integrated Circuit Card) allows attackers to bypass intended access restrictions on property values. The LG ID is LVE-SMP-200020 (September 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25283
Published: 2020-09-11
Description: An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. BT manager allows attackers to bypass intended access restrictions on a certain mode. The LG ID is LVE-SMP-200021 (September 2020).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://lgsecurity.lge.com/; https://lgsecurity.lge.com/
CVE: CVE-2020-25284
Published: 2020-09-13
Description: The rbd block device driver in drivers/block/rbd.c in the Linux kernel through 5.8.9 used incomplete permission checking for access to rbd devices, which could be leveraged by local attackers to map or unmap rbd block devices, aka CID-f44d04e696fe.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-863
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00021.html; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f44d04e696feaf13d192d942c4f14ad2e117065a
CVE: CVE-2020-25285
Published: 2020-09-13
Description: A race condition between hugetlb sysctl handlers in mm/hugetlb.c in the Linux kernel before 5.8.8 could be used by local attackers to corrupt memory, cause a NULL pointer dereference, or possibly have unspecified other impact, aka CID-17743798d812.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-476, CWE-787
References: https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.8.8; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=17743798d81238ab13050e8e2833699b54e15467; https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
CVE: CVE-2020-25286
Published: 2020-09-13
Description: In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public.
CVSS Score: 5.3 (MEDIUM)
References: https://core.trac.wordpress.org/changeset/47984; https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/; https://core.trac.wordpress.org/changeset/47984
CVE: CVE-2020-25287
Published: 2020-09-13
Description: Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admin_editor.php the_file=..%2Findex.php&open=Open request.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/jenaye/pligg/blob/master/README.md; https://github.com/jenaye/pligg/blob/master/README.md
CVE: CVE-2020-25289
Published: 2020-09-13
Description: The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory (which has weak permissions).
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://zeifan.my/security/arbitrary%20file/eop/2020/07/21/avast-secureline-vpn-arb-file-eop.html; http://zeifan.my/security/arbitrary%20file/eop/2020/07/21/avast-secureline-vpn-arb-file-eop.html
CVE: CVE-2020-25291
Published: 2020-09-13
Description: GdiDrawHoriLineIAlt in Kingsoft WPS Office before 11.2.0.9403 allows remote heap corruption via a crafted PLTE chunk in PNG data within a Word document. This is related to QBrush::setMatrix in gui/painting/qbrush.cpp in Qt 4.x.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://zeifan.my/security/rce/heap/2020/09/03/wps-rce-heap.html; http://zeifan.my/security/rce/heap/2020/09/03/wps-rce-heap.html
CVE: CVE-2020-21731
Published: 2020-09-14
Description: Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?user_name=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://gazie.com; http://gazie.devincentiis.it/; https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21731
CVE: CVE-2020-21732
Published: 2020-09-14
Description: Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://rukovoditel.com; https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21732; https://www.rukovoditel.net
CVE: CVE-2020-21733
Published: 2020-09-14
Description: Sagemcom F@ST3686 v1.0 HUN 3.97.0 has XSS via RgDiagnostics.asp, RgDdns.asp, RgFirewallEL.asp, RgVpnL2tpPptp.asp.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://sagemcom.com; http://sagemcomfst3686v10hun3970.com; https://github.com/Gr3gPr1est/BugReport/blob/master/CVE-2020-21733
CVE: CVE-2020-7807
Published: 2020-09-14
Description: A vulnerability that can hijack a DLL file that is loaded during products(LGPCSuite_Setup, IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) installation into a DLL file that the hacker wants. Missing Support for Integrity Check vulnerability in ____COMPONENT____ of LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) allows ____ATTACKER/ATTACK____ to cause ____IMPACT____. This issue affects: LG Electronics; LGPCSuite_Setup : 1.0.0.3 on Windows(x86, x64); IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup : 1.0.0.9 on Windows(x86, x64).
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-353, CWE-354
References: https://lgsecurity.lge.com/; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35587; https://lgsecurity.lge.com/
CVE: CVE-2020-24660
Published: 2020-09-14
Description: An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425
References: https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2; https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67; https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290
CVE: CVE-2020-25540
Published: 2020-09-14
Description: ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html; https://github.com/zoujingli/ThinkAdmin/issues/244; https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/
CVE: CVE-2018-20432
Published: 2020-09-14
Description: D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use hardcoded credentials for telnet connection, which allows unauthenticated attackers to gain privileged access to the router, and to extract sensitive data or modify the configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: http://packetstormsecurity.com/files/159058/COVR-3902-1.01B0-Hardcoded-Credentials.html; https://cybersecurityworks.com/zerodays/cve-2018-20432-dlink.html; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10109
CVE: CVE-2020-11683
Published: 2020-09-14
Description: A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-203
References: https://github.com/linux4sam/at91bootstrap/commit/7753914c9a622c245f3a3cf2af5e24b6a9904213; https://labs.f-secure.com/advisories/microchip-at91bootstrap/; https://github.com/linux4sam/at91bootstrap/commit/7753914c9a622c245f3a3cf2af5e24b6a9904213
CVE: CVE-2020-11684
Published: 2020-09-14
Description: AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-212
References: https://github.com/linux4sam/at91bootstrap/commit/[PII_REDACTED]9ffbf27c17ea7938499aca99168927; https://labs.f-secure.com/advisories/microchip-at91bootstrap/; https://github.com/linux4sam/at91bootstrap/commit/[PII_REDACTED]9ffbf27c17ea7938499aca99168927
CVE: CVE-2020-12787
Published: 2020-09-14
Description: Microchip Atmel ATSAMA5 products in Secure Mode allow an attacker to bypass existing security mechanisms related to applet handling.
CVSS Score: 7.5 (HIGH)
References: https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/; https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/
CVE: CVE-2020-12788
Published: 2020-09-14
Description: CMAC verification functionality in Microchip Atmel ATSAMA5 products is vulnerable to vulnerable to timing and power analysis attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/; https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/
CVE: CVE-2020-12789
Published: 2020-09-14
Description: The Secure Monitor in Microchip Atmel ATSAMA5 products use a hardcoded key to encrypt and authenticate secure applets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/; https://labs.f-secure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities/
CVE: CVE-2020-8817
Published: 2020-09-14
Description: Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata.
CVSS Score: 8.1 (HIGH)
References: https://doc.dataiku.com/dss/latest/release_notes/6.0.htm; https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-8817.html; https://doc.dataiku.com/dss/latest/release_notes/6.0.htm
CVE: CVE-2020-22158
Published: 2020-09-14
Description: MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the "path" or "Services+ID" parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS, an attacker must modify the "name" parameter with the malicious code.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://sku11army.blogspot.com/2020/02/ericsson-multiple-stored-reflected-xss.html; https://sku11army.blogspot.com/2020/02/ericsson-multiple-stored-reflected-xss.html
CVE: CVE-2020-25375
Published: 2020-09-14
Description: Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2; https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2
CVE: CVE-2020-25378
Published: 2020-09-14
Description: Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/; https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/
CVE: CVE-2020-25379
Published: 2020-09-14
Description: Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/; https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/
CVE: CVE-2020-25380
Published: 2020-09-14
Description: Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/; https://zeroaptitude.com/misha/wordpress-plugin-bug-hunting-part-2/
CVE: CVE-2019-0230
Published: 2020-09-14
Description: Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1321
References: http://packetstormsecurity.com/files/160108/Apache-Struts-2.5.20-Double-OGNL-Evaluation.html; http://packetstormsecurity.com/files/160721/Apache-Struts-2-Forced-Multi-OGNL-Evaluation.html; https://cwiki.apache.org/confluence/display/ww/s2-059
CVE: CVE-2019-0233
Published: 2020-09-14
Description: An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281
References: https://cwiki.apache.org/confluence/display/ww/s2-060; https://launchpad.support.sap.com/#/notes/2982840; https://www.oracle.com/security-alerts/cpuApr2021.html
CVE: CVE-2020-21845
Published: 2020-09-14
Description: Codoforum 4.8.3 allows HTML Injection in the 'admin dashboard Manage users Section.'
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://codoforum.com/; https://vyshnavvizz.blogspot.com/2020/01/html-injection-in-codoforum-v483.html; https://codoforum.com/
CVE: CVE-2019-14756
Published: 2020-09-14
Description: An issue was discovered in KaiOS 1.0, 2.5, and 2.5.12.5. The pre-installed Email application is vulnerable to HTML and JavaScript injection attacks. An attacker can send a specially crafted email to the victim that will inject HTML into the email application's UI as soon as the email is opened. At a bare minimum, this allows an attacker to take control over the Email application's UI (e.g., display a malicious prompt to the user asking them to re-enter their email credentials) and also allows an attacker to abuse any of the privileges available to the mobile application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.nccgroup.com/2020/08/21/technical-advisory-multiple-html-injection-vulnerabilities-in-kaios-pre-installed-mobile-applications/; https://research.nccgroup.com/2020/08/21/technical-advisory-multiple-html-injection-vulnerabilities-in-kaios-pre-installed-mobile-applications/
CVE: CVE-2020-0570
Published: 2020-09-14
Description: Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.
CVSS Score: 7.3 (HIGH)
CWE: CWE-426
References: https://bugreports.qt.io/browse/QTBUG-81272; https://bugzilla.redhat.com/show_bug.cgi?id=1800604; https://lists.qt-project.org/pipermail/development/2020-January/038534.html
CVE: CVE-2020-13284
Published: 2020-09-14
Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated CI Job Token
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13284.json; https://gitlab.com/gitlab-org/gitlab/-/issues/221040; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13284.json
CVE: CVE-2020-13287
Published: 2020-09-14
Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13287.json; https://gitlab.com/gitlab-org/gitlab/-/issues/227820; https://hackerone.com/reports/919468
CVE: CVE-2020-13289
Published: 2020-09-14
Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid username could be accepted when 2FA is activated.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-306
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13289.json; https://gitlab.com/gitlab-org/gitlab/-/issues/20302; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13289.json
CVE: CVE-2020-13299
Published: 2020-09-14
Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not revoking all session tokens and one could re-use it to obtain a valid session.
CVSS Score: 8.1 (HIGH)
CWE: CWE-613
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13299.json; https://gitlab.com/gitlab-org/gitlab/-/issues/222508; https://hackerone.com/reports/896225
CVE: CVE-2020-13300
Published: 2020-09-14
Description: GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in the middle of the authorization flow.
CVSS Score: 8.0 (HIGH)
CWE: CWE-863
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13300.json; https://gitlab.com/gitlab-org/gitlab/-/issues/219931; https://hackerone.com/reports/884766
CVE: CVE-2020-13316
Published: 2020-09-14
Description: A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line.
CVSS Score: 5.4 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13316.json; https://gitlab.com/gitlab-org/gitlab/-/issues/220137; https://hackerone.com/reports/884174
CVE: CVE-2020-13318
Published: 2020-09-14
Description: A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack.
CVSS Score: 6.4 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13318.json; https://gitlab.com/gitlab-org/gitlab/-/issues/228915; https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13318.json
CVE: CVE-2020-24457
Published: 2020-09-14
Description: Logic error in BIOS firmware for 8th, 9th and 10th Generation Intel(R) Core(TM) Processors may allow an unauthenticated user to potentially enable escalation of privilege, denial of service and/or information disclosure via physical access.
CVSS Score: 7.6 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00347.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00347.html
CVE: CVE-2020-25573
Published: 2020-09-14
Description: An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-824
References: https://github.com/contain-rs/linked-hash-map/pull/100; https://rustsec.org/advisories/RUSTSEC-2020-0026.html; https://github.com/contain-rs/linked-hash-map/pull/100
CVE: CVE-2020-25574
Published: 2020-09-14
Description: An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop).
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-835
References: https://github.com/hyperium/http/issues/352; https://rustsec.org/advisories/RUSTSEC-2019-0033.html; https://github.com/hyperium/http/issues/352
CVE: CVE-2020-25575
Published: 2020-09-14
Description: An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-843, CWE-843
References: https://boats.gitlab.io/blog/post/failure-to-fehler/; https://github.com/rust-lang-nursery/failure/issues/336; https://rustsec.org/advisories/RUSTSEC-2020-0036.html
CVE: CVE-2020-25576
Published: 2020-09-14
Description: An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-704
References: https://rustsec.org/advisories/RUSTSEC-2019-0035.html; https://rustsec.org/advisories/RUSTSEC-2019-0035.html
CVE: CVE-2019-14757
Published: 2020-09-14
Description: An issue was discovered in KaiOS 2.5 and 2.5.1. The pre-installed Contacts application is vulnerable to HTML and JavaScript injection attacks. An attacker can send a vCard file to the victim that will inject HTML into the Contacts application (assuming the victim chooses to import the file). At a bare minimum, this allows an attacker to take control over the Contacts application's UI (e.g., display a malicious prompt to the user asking them to re-enter credentials such as their KaiOS credentials to continue using the application) and also allows an attacker to abuse any of the privileges available to the mobile application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.nccgroup.com/2020/08/21/technical-advisory-multiple-html-injection-vulnerabilities-in-kaios-pre-installed-mobile-applications/; https://www.nccgroup.trust/us/our-research/; https://research.nccgroup.com/2020/08/21/technical-advisory-multiple-html-injection-vulnerabilities-in-kaios-pre-installed-mobile-applications/
CVE: CVE-2019-14758
Published: 2020-09-14
Description: An issue was discovered in KaiOS 2.5 and 2.5.1. The pre-installed File Manager application is vulnerable to HTML and JavaScript injection attacks. An attacker can send a file via email to the victim that will inject HTML into the File Manager application (assuming the victim chooses to download the email attachment). At a bare minimum, this allows an attacker to take control over the File Manager application's UI (e.g., display a malicious prompt to the user asking them to re-enter credentials such as their KaiOS credentials to continue using the application) and also allows an attacker to abuse any of the privileges available to the mobile application.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://research.nccgroup.com/2020/08/21/technical-advisory-multiple-html-injection-vulnerabilities-in-kaios-pre-installed-mobile-applications/; https://www.nccgroup.trust/us/our-research/; https://research.nccgroup.com/2020/08/21/technical-advisory-multiple-html-injection-vulnerabilities-in-kaios-pre-installed-mobile-applications/
CVE: CVE-2019-14759
Published: 2020-09-14
Description: An issue was discovered in KaiOS 1.0, 2.5, and 2.5.1. The pre-installed Radio application is vulnerable to HTML and JavaScript injection attacks. A local attacker can inject arbitrary HTML into the Radio application. At a bare minimum, this allows an attacker to take control over the Radio application's UI (e.g., display a malicious prompt to the user asking them to re-enter credentials such as their KaiOS credentials to continue using the application) and also allows an attacker to abuse any of the privileges available to the mobile application.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79
References: https://www.nccgroup.trust/us/our-research/; https://www.nccgroup.trust/us/our-research/