deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-12876
Published: 2020-05-14
Description: Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server. This vulnerability only impacts Windows server deployments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://www.veritas.com/content/support/en_US/security/VTS20-003; https://www.veritas.com/content/support/en_US/security/VTS20-003
CVE: CVE-2020-12877
Published: 2020-05-14
Description: Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306
References: https://www.veritas.com/content/support/en_US/security/VTS20-003; https://www.veritas.com/content/support/en_US/security/VTS20-003
CVE: CVE-2020-0024
Published: 2020-05-14
Description: In onCreate of SettingsBaseActivity.java, there is a possible unauthorized setting modification due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-8.0Android ID: A-137015265
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0064
Published: 2020-05-14
Description: An improper authorization while processing the provisioning data.Product: AndroidVersions: Android SoCAndroid ID: A-149866855
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0065
Published: 2020-05-14
Description: An improper authorization in the receiver component of the Android Suite Daemon.Product: AndroidVersions: Android SoCAndroid ID: A-149813448
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0090
Published: 2020-05-14
Description: An improper authorization in the receiver component of Email.Product: AndroidVersions: Android SoCAndroid ID: A-149813048
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0091
Published: 2020-05-14
Description: In mnld, an incorrect configuration in driver_cfg of mnld for meta factory mode.Product: AndroidVersions: Android SoCAndroid ID: A-149808700
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0092
Published: 2020-05-14
Description: In setHideSensitive of NotificationStackScrollLayout.java, there is a possible disclosure of sensitive notification content due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145135488
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0093
Published: 2020-05-14
Description: In exif_data_save_data_entry of exif-data.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148705132
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00017.html; https://lists.debian.org/debian-lts-announce/2020/05/msg00016.html; https://security.gentoo.org/glsa/202007-05
CVE: CVE-2020-0094
Published: 2020-05-14
Description: In setImageHeight and setImageWidth of ExifUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-148223871
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0096
Published: 2020-05-14
Description: In startActivities of ActivityStartController.java, there is a possible escalation of privilege due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9Android ID: A-145669109
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0097
Published: 2020-05-14
Description: In various methods of PackageManagerService.java, there is a possible permission bypass due to a missing condition for system apps. This could lead to local escalation of privilege with User privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-145981139
CVSS Score: 7.8 (HIGH)
CWE: CWE-863
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0098
Published: 2020-05-14
Description: In navigateUpToLocked of ActivityStack.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.0 Android-8.1 Android-9Android ID: A-144285917
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0100
Published: 2020-05-14
Description: In onTransact of IHDCP.cpp, there is a possible out of bounds read due to incorrect error handling. This could lead to local information disclosure of data from a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-8.0Android ID: A-150156584
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0101
Published: 2020-05-14
Description: In BnCrypto::onTransact of ICrypto.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144767096
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908, CWE-909
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0102
Published: 2020-05-14
Description: In GattServer::SendResponse of gatt_server.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143231677
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0103
Published: 2020-05-14
Description: In a2dp_aac_decoder_cleanup of a2dp_aac_decoder.cc, there is a possible invalid free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-9Android ID: A-148107188
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-763, CWE-787
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0104
Published: 2020-05-14
Description: In onShowingStateChanged of KeyguardStateMonitor.java, there is a possible inappropriate read due to a logic error. This could lead to local information disclosure of keyguard-protected data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-144430870
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0105
Published: 2020-05-14
Description: In onKeyguardVisibilityChanged of key_store_service.cpp, there is a missing permission check. This could lead to local escalation of privilege, allowing apps to use keyguard-bound keys when the screen is locked, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-144285084
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0106
Published: 2020-05-14
Description: In getCellLocation of PhoneInterfaceManager.java, there is a possible permission bypass due to a missing SDK version check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-148414207
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0109
Published: 2020-05-14
Description: In simulatePackageSuspendBroadcast of NotificationManagerService.java, there is a missing permission check. This could lead to local escalation of privilege by creating fake system notifications with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-148059175
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/2020-05-01; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0110
Published: 2020-05-14
Description: In psi_write of psi.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-148159562References: Upstream kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2020-05-01; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00533.html; https://source.android.com/security/bulletin/2020-05-01
CVE: CVE-2020-0220
Published: 2020-05-14
Description: In crus_afe_callback of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-139739561
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2020-05-01; https://source.android.com/security/bulletin/pixel/2020-05-01
CVE: CVE-2020-0221
Published: 2020-05-14
Description: Airbrush FW's scratch memory allocator is susceptible to numeric overflow. When the overflow occurs, the next allocation could potentially return a pointer within the previous allocation's memory, which could lead to improper memory access.Product: AndroidVersions: Android kernelAndroid ID: A-135772851
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-682
References: https://source.android.com/security/bulletin/pixel/2020-05-01; https://source.android.com/security/bulletin/pixel/2020-05-01
CVE: CVE-2020-10612
Published: 2020-05-14
Description: Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting or stopping service, or writing to certain registry values.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-284, CWE-862
References: https://www.us-cert.gov/ics/advisories/icsa-20-135-01; https://www.us-cert.gov/ics/advisories/icsa-20-135-01
CVE: CVE-2020-10616
Published: 2020-05-14
Description: Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can replace them and execute code whenever the service starts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.us-cert.gov/ics/advisories/icsa-20-135-01; https://www.us-cert.gov/ics/advisories/icsa-20-135-01
CVE: CVE-2020-10620
Published: 2020-05-14
Description: Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication does not include any credentials. This allows an attacker with network access to directly communicate with SoftPAC, including, for example, stopping the service remotely.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-285, CWE-862
References: https://www.us-cert.gov/ics/advisories/icsa-20-135-01; https://www.us-cert.gov/ics/advisories/icsa-20-135-01
CVE: CVE-2020-12042
Published: 2020-05-14
Description: Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within the zip files used to update the SoftPAC firmware are not sanitized. As a result, an attacker with user privileges can gain arbitrary file write access with system access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://www.us-cert.gov/ics/advisories/icsa-20-135-01; https://www.us-cert.gov/ics/advisories/icsa-20-135-01
CVE: CVE-2020-12046
Published: 2020-05-14
Description: Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC’s firmware files’ signatures are not verified upon firmware update. This allows an attacker to replace legitimate firmware files with malicious files.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: https://www.us-cert.gov/ics/advisories/icsa-20-135-01; https://www.us-cert.gov/ics/advisories/icsa-20-135-01
CVE: CVE-2020-12068
Published: 2020-05-14
Description: An issue was discovered in CODESYS Development System before 3.5.16.0. CODESYS WebVisu and CODESYS Remote TargetVisu are susceptible to privilege escalation.
CVSS Score: 6.5 (MEDIUM)
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13136&token=c267875c01ea70bc9613bc39c684eedc17f55420&download=; https://www.codesys.com; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=13136&token=c267875c01ea70bc9613bc39c684eedc17f55420&download=
CVE: CVE-2020-12440
Published: 2020-05-14
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2020-11931
Published: 2020-05-15
Description: An Ubuntu-specific modification to Pulseaudio to provide security mediation for Snap-packaged applications was found to have a bypass of intended access restriction for snaps which plugs any of pulseaudio, audio-playback or audio-record via unloading the pulseaudio snap policy module. This issue affects: pulseaudio 1:8.0 versions prior to 1:8.0-0ubuntu3.12; 1:11.1 versions prior to 1:11.1-1ubuntu7.7; 1:13.0 versions prior to 1:13.0-1ubuntu1.2; 1:13.99.1 versions prior to 1:13.99.1-1ubuntu3.2;
CVSS Score: 3.3 (LOW)
CWE: CWE-284, CWE-668
References: https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3; https://usn.ubuntu.com/4355-1/; https://forum.snapcraft.io/t/audio-switcher-pulseaudio-interface-auto-connect-request/16648/3
CVE: CVE-2020-12882
Published: 2020-05-15
Description: Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/157756/Submitty-20.04.01-Cross-Site-Scripting.html; https://github.com/Submitty/Submitty/issues/5266; http://packetstormsecurity.com/files/157756/Submitty-20.04.01-Cross-Site-Scripting.html
CVE: CVE-2020-8100
Published: 2020-05-15
Description: Improper Input Validation vulnerability in the cevakrnl.rv0 module as used in the Bitdefender Engines allows an attacker to trigger a denial of service while scanning a specially-crafted sample. This issue affects: Bitdefender Bitdefender Engines versions prior to 7.84063.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://www.bitdefender.com/support/security-advisories/incomplete-validation-detection-code-bitdefender-engines-va-8589/; https://www.bitdefender.com/support/security-advisories/incomplete-validation-detection-code-bitdefender-engines-va-8589/
CVE: CVE-2020-10744
Published: 2020-05-15
Description: An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-377, CWE-362
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744
CVE: CVE-2020-1808
Published: 2020-05-15
Description: Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.176(C00E60R2P11);9.1.0.135(C00E133R2P1); versions earlier than 10.1.0.123(C431E22R3P5), versions earlier than 10.1.0.126(C636E5R3P4), versions earlier than 10.1.0.160(C00E160R2P11); versions earlier than 10.1.0.126(C185E8R5P1), versions earlier than 10.1.0.126(C636E9R2P4), versions earlier than 10.1.0.160(C00E160R2P8); versions earlier than 10.0.0.179(C636E3R4P3), versions earlier than 10.0.0.180(C185E3R3P3), versions earlier than 10.0.0.180(C432E10R3P4), versions earlier than 10.0.0.181(C675E5R1P2) have an out of bound read vulnerability. The software reads data past the end of the intended buffer. The attacker tricks the user into installing a crafted application, successful exploit may cause information disclosure or service abnormal.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-02-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-02-smartphone-en
CVE: CVE-2020-3810
Published: 2020-05-15
Description: Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://bugs.launchpad.net/bugs/1878177; https://github.com/Debian/apt/issues/111; https://lists.debian.org/debian-security-announce/2020/msg00089.html
CVE: CVE-2020-9073
Published: 2020-05-15
Description: Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1P4) have an improper authentication vulnerability. The vulnerability is due to that when an user wants to do certain operation, the software insufficiently validate the user's identity. Attackers need to physically access the smartphone to exploit this vulnerability. Successful exploit could allow the attacker to bypass the limit of student mode function.
CVSS Score: 2.4 (LOW)
CWE: CWE-287
References: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-01-smartphone-en; https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200513-01-smartphone-en
CVE: CVE-2020-7809
Published: 2020-05-15
Description: ALSong 3.46 and earlier version contain a Document Object Model (DOM) based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Album(sab) file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.altools.co.kr/support/Notice_Contents.aspx?idx=1808&page=3&t=; https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35409; https://www.altools.co.kr/support/Notice_Contents.aspx?idx=1808&page=3&t=
CVE: CVE-2018-10756
Published: 2020-05-15
Description: Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted torrent file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://github.com/transmission/transmission/commit/2123adf8e5e1c2b48791f9d22fc8c747e974180e; https://lists.debian.org/debian-lts-announce/2020/05/msg00022.html; https://lists.debian.org/debian-lts-announce/2020/08/msg00001.html
CVE: CVE-2020-11521
Published: 2020-05-15
Description: libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html; https://github.com/FreeRDP/FreeRDP/commits/master; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cwc-6wc9-255w
CVE: CVE-2020-11522
Published: 2020-05-15
Description: libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out-of-bounds Read.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html; https://github.com/FreeRDP/FreeRDP/commits/master; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-48wx-7vgj-fffh
CVE: CVE-2020-11523
Published: 2020-05-15
Description: libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Integer Overflow.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html; https://github.com/FreeRDP/FreeRDP/commits/master; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qrh-8cp8-4x42
CVE: CVE-2020-11524
Published: 2020-05-15
Description: libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out-of-bounds Write.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html; https://github.com/FreeRDP/FreeRDP/commits/master; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgw8-3mp2-p5qw
CVE: CVE-2020-11525
Published: 2020-05-15
Description: libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-rc4 has an Out of bounds read.
CVSS Score: 2.2 (LOW)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html; https://github.com/FreeRDP/FreeRDP/commits/master; https://github.com/FreeRDP/FreeRDP/pull/6019/commits/58dc36b3c883fd460199cedb6d30e58eba58298c
CVE: CVE-2020-11526
Published: 2020-05-15
Description: libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc4 has an Out-of-bounds Read.
CVSS Score: 2.2 (LOW)
CWE: CWE-125, CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html; https://github.com/FreeRDP/FreeRDP/commits/master; https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97jw-m5w5-xvf9
CVE: CVE-2020-12685
Published: 2020-05-15
Description: XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.interchangecommerce.org; https://www.interchangecommerce.org/i/dev/news?mv_arg=00064; https://www.interchangecommerce.org