deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-1655
Published: 2020-07-17
Description: When a device running Juniper Networks Junos OS with MPC7, MPC8, or MPC9 line cards installed and the system is configured for inline IP reassembly, used by L2TP, MAP-E, GRE, and IPIP, the packet forwarding engine (PFE) will become disabled upon receipt of large packets requiring fragmentation, generating the following error messages: [LOG: Err] MQSS(0): WO: Packet Error - Error Packets 1, Connection 29 [LOG: Err] eachip_hmcif_rx_intr_handler(7259): EA[0:0]: HMCIF Rx: Injected checksum error detected on WO response - Chunk Address 0x0 [LOG: Err] MQSS(0): DRD: RORD1: CMD reorder ID error - Command 11, Reorder ID 1838, QID 0 [LOG: Err] MQSS(0): DRD: UNROLL0: HMC chunk length error in stage 5 - Chunk Address: 0x4321f3 [LOG: Err] MQSS(0): DRD: UNROLL0: HMC chunk address error in stage 5 - Chunk Address: 0x0 [LOG: Notice] Error: /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc), scope: pfe, category: functional, severity: major, module: MQSS(0), type: DRD_RORD_ENG_INT: CMD FSM State Error [LOG: Notice] Performing action cmalarm for error /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(0) with scope: pfe category: functional level: major [LOG: Notice] Performing action get-state for error /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(0) with scope: pfe category: functional level: major [LOG: Notice] Performing action disable-pfe for error /fpc/8/pfe/0/cm/0/MQSS(0)/0/MQSS_CMERROR_DRD_RORD_ENG_INT_REG_CMD_FSM_STATE_ERR (0x2203cc) in module: MQSS(0) with scope: pfe category: functional level: major By continuously sending fragmented packets that cannot be reassembled, an attacker can repeatedly disable the PFE causing a sustained Denial of Service (DoS). This issue affects Juniper Networks Junos OS: 17.2 versions prior to 17.2R3-S4 on MX Series; 17.3 versions prior to 17.3R3-S8 on MX Series; 17.4 versions prior to 17.4R2-S10, 17.4R3-S2 on MX Series; 18.1 versions prior to 18.1R3-S10 on MX Series; 18.2 versions prior to 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D41, 18.2X75-D430, 18.2X75-D65 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S4, 18.3R3-S1 on MX Series; 18.4 versions prior to 18.4R1-S7, 18.4R2-S4, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3 on MX Series; 19.2 versions prior to 19.2R1-S4, 19.2R2 on MX Series; 19.3 versions prior to 19.3R2-S2, 19.3R3 on MX Series. This issue is specific to inline IP reassembly, introduced in Junos OS 17.2. Versions of Junos OS prior to 17.2 are unaffected by this vulnerability.
CVSS Score: 5.3 (MEDIUM)
References: https://kb.juniper.net/JSA11041; https://www.juniper.net/documentation/en_US/junos/topics/topic-map/l2tp-lns-inline-service-interfaces.html; https://kb.juniper.net/JSA11041
CVE: CVE-2019-4090
Published: 2020-07-17
Description: "HCL Campaign is vulnerable to cross-site scripting when a user provides XSS scripts in Campaign Description field."
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080448; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080448
CVE: CVE-2019-4091
Published: 2020-07-17
Description: "HCL Marketing Platform is vulnerable to cross-site scripting during addition of new users and also while searching for users in Dashboard, potentially giving an attacker ability to inject malicious code into the system. "
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080437; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080437
CVE: CVE-2020-0120
Published: 2020-07-17
Description: In notifyErrorForPendingRequests of QCamera3HWI.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-149995442
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-06-01; https://source.android.com/security/bulletin/pixel/2020-06-01
CVE: CVE-2020-0305
Published: 2020-07-17
Description: In cdev_get of char_dev.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-153467744
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-362, CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00009.html; http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html; https://source.android.com/security/bulletin/pixel/2020-06-01
CVE: CVE-2020-15816
Published: 2020-07-17
Description: In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute code in the application's process through library injection by using DYLD environment variables.
CVSS Score: 8.8 (HIGH)
CWE: CWE-668
References: https://www.westerndigital.com/support/productsecurity/wdc-20005-wd-discovery-remote-command-execution-vulnerability; https://www.westerndigital.com/support/productsecurity/wdc-20005-wd-discovery-remote-command-execution-vulnerability
CVE: CVE-2020-0107
Published: 2020-07-17
Description: In getUiccCardsInfo of PhoneInterfaceManager.java, there is a possible permissions bypass due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146570216
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0122
Published: 2020-07-17
Description: In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147247775
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0224
Published: 2020-07-17
Description: In FastKeyAccumulator::GetKeysSlow of keys.cc, there is a possible out of bounds write due to type confusion. This could lead to remote code execution when processing a proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147664838
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-843
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0225
Published: 2020-07-17
Description: In a2dp_vendor_ldac_decoder_decode_packet of a2dp_vendor_ldac_decoder.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142546668
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0226
Published: 2020-07-17
Description: In createWithSurfaceParent of Client.cpp, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege in the graphics server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-150226994
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-843
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0227
Published: 2020-07-17
Description: In onCommand of CompanionDeviceManagerService.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege allowing background data usage or launching from the background, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-129476618
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0228
Published: 2020-07-17
Description: There is an improper configuration of recorder related service. Product: AndroidVersions: Android SoCAndroid ID: A-156333723
CVSS Score: 7.5 (HIGH)
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0230
Published: 2020-07-17
Description: There is a possible out of bounds write due to an incorrect bounds check. Product: AndroidVersions: Android SoCAndroid ID: A-156337262
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-0231
Published: 2020-07-17
Description: There is a possible out of bounds write due to an incorrect bounds check. Product: AndroidVersions: Android SoCAndroid ID: A-156333727
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-07-01; https://source.android.com/security/bulletin/2020-07-01
CVE: CVE-2020-15108
Published: 2020-07-17
Description: In glpi before 9.5.1, there is a SQL injection for all usages of "Clone" feature. This has been fixed in 9.5.1.
CVSS Score: 7.1 (HIGH)
CWE: CWE-89, CWE-89
References: https://github.com/glpi-project/glpi/commit/a4baa64114eb92fd2adf6056a36e[PII_REDACTED]ba; https://github.com/glpi-project/glpi/pull/6684; https://github.com/glpi-project/glpi/security/advisories/GHSA-qv6w-68gq-wx2v
CVE: CVE-2020-15110
Published: 2020-07-17
Description: In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://github.com/jupyterhub/kubespawner/commit/3dfe870a7f5e98e2e398b01996ca6b8eff4bb1d0; https://github.com/jupyterhub/kubespawner/security/advisories/GHSA-v7m9-9497-p9gr; https://github.com/jupyterhub/kubespawner/commit/3dfe870a7f5e98e2e398b01996ca6b8eff4bb1d0
CVE: CVE-2020-4104
Published: 2020-07-17
Description: HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. An attacker can use XSS to send a malicious script to an unsuspecting user. This affects all versions prior to latest releases as specified in https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855&sys_kb_id=971d99ed1b8ed01c086dcbfc0a4bcb6a.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855; https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080855
CVE: CVE-2020-5756
Published: 2020-07-17
Description: Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.
CVSS Score: 8.8 (HIGH)
CWE: CWE-489, CWE-78
References: https://www.tenable.com/security/research/tra-2020-41; https://www.tenable.com/cve/CVE-2020-5756; https://www.tenable.com/security/research/tra-2020-41
CVE: CVE-2020-5757
Published: 2020-07-17
Description: Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.tenable.com/security/research/tra-2020-42; https://www.tenable.com/cve/CVE-2020-5757; https://www.tenable.com/security/research/tra-2020-42
CVE: CVE-2020-5758
Published: 2020-07-17
Description: Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.tenable.com/security/research/tra-2020-42; https://www.tenable.com/cve/CVE-2020-5758; https://www.tenable.com/security/research/tra-2020-42
CVE: CVE-2020-5759
Published: 2020-07-17
Description: Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.tenable.com/security/research/tra-2020-42; https://www.tenable.com/cve/CVE-2020-5759; https://www.tenable.com/security/research/tra-2020-42
CVE: CVE-2019-12000
Published: 2020-07-17
Description: HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used between the USSD and an external USSD service logic application. Update to version 3.2 and update the HTTPS configuration as described in the HPE MSE Messaging Gateway Configuration and Operations Guide.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-295
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03979en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03979en_us
CVE: CVE-2020-10605
Published: 2020-07-17
Description: Grundfos CIM 500 before v06.16.00 responds to unauthenticated requests for password storage files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://us-cert.cisa.gov/ics/advisories/icsa-20-189-01; https://us-cert.cisa.gov/ics/advisories/icsa-20-189-01
CVE: CVE-2020-5767
Published: 2020-07-17
Description: Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://www.tenable.com/security/research/tra-2020-44-0; https://www.tenable.com/security/research/tra-2020-44-0
CVE: CVE-2020-5768
Published: 2020-07-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://www.tenable.com/security/research/tra-2020-44-0; https://www.tenable.com/security/research/tra-2020-44-0
CVE: CVE-2020-5769
Published: 2020-07-17
Description: Insufficient output sanitization in Teltonika firmware TRB2_R_00.02.02 allows a remote, authenticated attacker to conduct persistent cross-site scripting (XSS) attacks by injecting malicious client-side code into the 'URL/ Host / Connection' form in the 'DATA TO SERVER' configuration section.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.tenable.com/security/research/tra-2020-43-0; https://www.tenable.com/security/research/tra-2020-43-0
CVE: CVE-2020-7206
Published: 2020-07-17
Description: HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/HewlettPackard/nagios-plugins-hpilo/commit/7617b2736a95c7f354198f092febe37e7005c677; https://github.com/HewlettPackard/nagios-plugins-hpilo/commit/7617b2736a95c7f354198f092febe37e7005c677
CVE: CVE-2020-7818
Published: 2020-07-17
Description: DaviewIndy 8.98.9 and earlier has a Heap-based overflow vulnerability, triggered when the user opens a malformed PDF file that is mishandled by Daview.exe. Attackers could exploit this and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: https://www.hmtalk.com/; https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35521; https://www.hmtalk.com/
CVE: CVE-2020-9102
Published: 2020-07-17
Description: There is a information leak vulnerability in some Huawei products, and it could allow a local attacker to get information. The vulnerability is due to the improper management of the username. An attacker with the ability to access the device and cause the username information leak. Affected product versions include: CloudEngine 12800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R019C00SPC800; CloudEngine 5800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R019C00SPC800; CloudEngine 6800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R005C20SPC800, V200R019C00SPC800; CloudEngine 7800 versions V200R002C50SPC800, V200R003C00SPC810, V200R005C00SPC800, V200R005C10SPC800, V200R019C00SPC800
CVSS Score: 3.3 (LOW)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-03-informationleak-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-03-informationleak-en
CVE: CVE-2020-9227
Published: 2020-07-17
Description: Huawei Smart Phones Moana-AL00B with versions earlier than 10.1.0.166 have a missing initialization of resource vulnerability. An attacker tricks the user into installing then running a crafted application. Due to improper initialization of specific parameters, successful exploit of this vulnerability may cause device exceptions.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-909
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-09-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-09-smartphone-en
CVE: CVE-2020-9252
Published: 2020-07-17
Description: HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8), HUAWEI Mate 20 X versions earlier than 10.1.0.135(C00E135R2P8), HUAWEI Mate 20 RS versions earlier than 10.1.0.160(C786E160R3P8), and Honor Magic2 smartphones versions earlier than 10.1.0.160(C00E160R2P11) have a path traversal vulnerability. The system does not sufficiently validate certain pathname from certain process, successful exploit could allow the attacker write files to a crafted path.
CVSS Score: 2.3 (LOW)
CWE: CWE-22
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-07-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-07-smartphone-en
CVE: CVE-2020-9254
Published: 2020-07-17
Description: HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 10.1.0.160(C00E160R2P8) have a logic check error vulnerability. A logic error occurs when the software checking the size of certain parameter, the attacker should trick the user into installing a malicious application, successful exploit may cause code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-04-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-04-smartphone-en
CVE: CVE-2020-9255
Published: 2020-07-17
Description: Huawei Honor 10 smartphones with versions earlier than 10.0.0.178(C00E178R1P4) have a denial of service vulnerability. Certain service in the system does not sufficiently validate certain parameter which is received, the attacker should trick the user into installing a malicious application, successful exploit could cause a denial of service condition.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-06-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-06-smartphone-en
CVE: CVE-2020-9257
Published: 2020-07-17
Description: HUAWEI P30 Pro smartphones with versions earlier than 10.1.0.123(C432E19R2P5patch02), versions earlier than 10.1.0.126(C10E11R5P1), and versions earlier than 10.1.0.160(C00E160R2P8) have a buffer overflow vulnerability. The software access data past the end, or before the beginning, of the intended buffer when handling certain operations of certificate, the attacker should trick the user into installing a malicious application, successful exploit may cause code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-03-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-03-smartphone-en
CVE: CVE-2020-9259
Published: 2020-07-17
Description: Huawei Honor V30 smartphones with versions earlier than 10.1.0.212(C00E210R5P1) have an improper authentication vulnerability. The system does not sufficiently validate certain parameter passed from the bottom level, the attacker should trick the user into installing a malicious application and control the bottom level, successful exploit could cause information disclosure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-02-smartphone-en
CVE: CVE-2020-9101
Published: 2020-07-18
Description: There is an out-of-bounds write vulnerability in some products. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot. Affected product versions include: IPS Module versions V500R005C00, V500R005C10; NGFW Module versions V500R005C00, V500R005C10; Secospace USG6300 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; Secospace USG6500 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; Secospace USG6600 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10; USG9500 versions V500R001C30, V500R001C60, V500R005C00, V500R005C10
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-01-outofboundswrite-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-01-outofboundswrite-en
CVE: CVE-2020-9256
Published: 2020-07-18
Description: Huawei Mate 30 Pro smartphones with versions earlier than 10.1.0.150(C00E136R5P3) have an improper authorization vulnerability. The system does not properly restrict the use of system service by applications, the attacker should trick the user into installing a malicious application, successful exploit could cause a denial of audio service.
CVSS Score: 6.5 (MEDIUM)
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-05-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200715-05-smartphone-en
CVE: CVE-2020-15841
Published: 2020-07-20
Description: Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 89, 7.1 before fix pack 17, and 7.2 before fix pack 4, does not safely test a connection to a LDAP server, which allows remote attackers to obtain the LDAP server's password via the Test LDAP Connection feature.
CVSS Score: 8.3 (HIGH)
References: https://issues.liferay.com/browse/LPE-16928; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317439; https://issues.liferay.com/browse/LPE-16928