deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-0324
Published: 2020-09-17
Description: In libsonivox, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-136660304
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0328
Published: 2020-09-17
Description: In the camera, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150156131
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-125, CWE-190
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0329
Published: 2020-09-17
Description: In the OMX encoder, there is a possible out of bounds read due to invalid input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-63522940
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0330
Published: 2020-09-17
Description: In iorap, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege and code execution with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150331085
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-416, CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0332
Published: 2020-09-17
Description: In libstagefright, there is a possible dead loop due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124783982
CVSS Score: 6.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0333
Published: 2020-09-17
Description: In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-73822755
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0336
Published: 2020-09-17
Description: In SurfaceFlinger, there is possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153467444
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787, CWE-843
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0337
Published: 2020-09-17
Description: In MediaProvider, there is a possible bypass of a permissions check due to a confused deputy. This could lead to local information disclosure, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124329382
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0338
Published: 2020-09-17
Description: In checkKeyIntent of AccountManagerService.java, there is a possible permission bypass. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-9Android ID: A-123700107
CVSS Score: 5.0 (MEDIUM)
References: https://source.android.com/security/bulletin/2022-01-01; https://source.android.com/security/bulletin/2022-01-01
CVE: CVE-2020-0340
Published: 2020-09-17
Description: In libcodec2_soft_mp3dec, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-144901522
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0341
Published: 2020-09-17
Description: In DisplayManager, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-144920149
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0343
Published: 2020-09-17
Description: In NetworkStatsService, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-119672472
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0344
Published: 2020-09-17
Description: In MediaProvider, there is a possible permissions bypass due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-140729887
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0345
Published: 2020-09-17
Description: In DocumentsUI, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-144286721
CVSS Score: 7.8 (HIGH)
CWE: CWE-610
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0346
Published: 2020-09-17
Description: In Mediaserver, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if integer sanitization were not enabled (which it is by default), with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-147002762
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0351
Published: 2020-09-17
Description: In libstagefright, there is possible CPU exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124777537
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0352
Published: 2020-09-17
Description: In MediaProvider, there is a possible permissions bypass due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-132074310
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0353
Published: 2020-09-17
Description: In libmp4extractor, there is a possible resource exhaustion due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124777526
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-770
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0355
Published: 2020-09-17
Description: In libFraunhoferAAC, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-141883493
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0356
Published: 2020-09-17
Description: In the Audio HAL, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-143787559
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0357
Published: 2020-09-17
Description: In SurfaceFlinger, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the graphics server with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150225569
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-667
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0358
Published: 2020-09-17
Description: In SurfaceFlinger, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150227563
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-367, CWE-416
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0359
Published: 2020-09-17
Description: In GLESRenderEngine, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150303018
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0360
Published: 2020-09-17
Description: In Notification Access Confirmation, there is a possible permissions bypass due to uninformed consent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-145129456
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0361
Published: 2020-09-17
Description: In libDRCdec, there is a possible information disclosure due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151927433
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-908
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0362
Published: 2020-09-17
Description: In libstagefright, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-123237930
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0363
Published: 2020-09-17
Description: In libmedia, there is a possible resource exhaustion due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-132274514
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0364
Published: 2020-09-17
Description: In libDRCdec, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-137282770
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0366
Published: 2020-09-17
Description: In PackageInstaller, there is a possible permissions bypass due to a tapjacking vulnerability. This could lead to local escalation of privilege using an app set as the default Assist app with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-138443815
CVSS Score: 7.8 (HIGH)
CWE: CWE-1021
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0369
Published: 2020-09-17
Description: In libavb, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-130231426
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0370
Published: 2020-09-17
Description: In libAACdec, there is a possible out of bounds read due to missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-112051700
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0372
Published: 2020-09-17
Description: In ActivityManager, there is a possible access to protected data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-119673147
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0373
Published: 2020-09-17
Description: In SoundTriggerHwService, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-146894086
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-125, CWE-362
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0374
Published: 2020-09-17
Description: In NFC, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156251602
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0375
Published: 2020-09-17
Description: In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege and the setting of supported EUICC countries with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156253476
CVSS Score: 7.8 (HIGH)
CWE: CWE-862
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0406
Published: 2020-09-17
Description: In libmpeg2dec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if another exploit allowed this to be triggered with different parameters, with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-137794014
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0425
Published: 2020-09-17
Description: There is a possible way to view notifications even when the "Lockdown" feature is on. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-124000380
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-0426
Published: 2020-09-17
Description: In SyncManager, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154921790
CVSS Score: 5.5 (MEDIUM)
References: https://source.android.com/security/bulletin/android-11; https://source.android.com/security/bulletin/android-11
CVE: CVE-2020-15184
Published: 2020-09-17
Description: In Helm before versions 2.16.11 and 3.3.2 there is a bug in which the `alias` field on a `Chart.yaml` is not properly sanitized. This could lead to the injection of unwanted information into a chart. This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the `dependencies` field of any untrusted chart, verifying that the `alias` field is either not used, or (if used) does not contain newlines or path characters.
CVSS Score: 3.7 (LOW)
CWE: CWE-20, CWE-74
References: https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850; https://github.com/helm/helm/security/advisories/GHSA-9vp5-m38w-j776; https://github.com/helm/helm/commit/e7c281564d8306e1dcf8023d97f972449ad74850
CVE: CVE-2020-15185
Published: 2020-09-17
Description: In Helm before versions 2.16.11 and 3.3.2, a Helm repository can contain duplicates of the same chart, with the last one always used. If a repository is compromised, this lowers the level of access that an attacker needs to inject a bad chart into a repository. To perform this attack, an attacker must have write access to the index file (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 3.3.2 and 2.16.11. A possible workaround is to manually review the index file in the Helm repository cache before installing software.
CVSS Score: 2.2 (LOW)
CWE: CWE-74, CWE-694
References: https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc; https://github.com/helm/helm/security/advisories/GHSA-jm56-5h66-w453; https://github.com/helm/helm/commit/055dd41cbe53ce131ab0357524a7f6729e6e40dc
CVE: CVE-2020-15186
Published: 2020-09-17
Description: In Helm before versions 2.16.11 and 3.3.2 plugin names are not sanitized properly. As a result, a malicious plugin author could use characters in a plugin name that would result in unexpected behavior, such as duplicating the name of another plugin or spoofing the output to `helm --help`. This issue has been patched in Helm 3.3.2. A possible workaround is to not install untrusted Helm plugins. Examine the `name` field in the `plugin.yaml` file for a plugin, looking for characters outside of the [a-zA-Z0-9._-] range.
CVSS Score: 3.4 (LOW)
CWE: CWE-20, CWE-74
References: https://github.com/helm/helm/commit/809e2d999e2c33e20e77f6bff30652d79c287542; https://github.com/helm/helm/security/advisories/GHSA-m54r-vrmv-hw33; https://github.com/helm/helm/commit/809e2d999e2c33e20e77f6bff30652d79c287542
CVE: CVE-2020-15187
Published: 2020-09-17
Description: In Helm before versions 2.16.11 and 3.3.2, a Helm plugin can contain duplicates of the same entry, with the last one always used. If a plugin is compromised, this lowers the level of access that an attacker needs to modify a plugin's install hooks, causing a local execution attack.
To perform this attack, an attacker must have write access to the git repository or plugin archive (.tgz) while being downloaded (which can occur during a MITM attack on a non-SSL connection). This issue has been patched in Helm 2.16.11 and Helm 3.3.2.
As a possible workaround make sure to install plugins using a secure connection protocol like SSL.
CVSS Score: 3.0 (LOW)
CWE: CWE-74, CWE-694
References: https://github.com/helm/helm/commit/6aab63765f99050b115f0aec3d6350c85e8da946; https://github.com/helm/helm/commit/ac7c07c37d87e09797f714fb57aa5e9cb99d9450; https://github.com/helm/helm/commit/b0296c0522e837d65f944beefa3fb64fd08ac304
CVE: CVE-2020-25733
Published: 2020-09-18
Description: webTareas through 2.1 allows upload of the dangerous .exe and .shtml file types.
CVSS Score: 7.5 (HIGH)
CWE: CWE-434
References: https://medium.com/%40tehwinsam/webtareas-2-1-c8b406c68c2a; https://sourceforge.net/p/webtareas/tickets/40/; https://sourceforge.net/projects/webtareas/files/
CVE: CVE-2020-25734
Published: 2020-09-18
Description: webTareas through 2.1 allows files/Default/ Directory Listing.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://medium.com/%40tehwinsam/webtareas-2-1-c8b406c68c2a; https://sourceforge.net/p/webtareas/tickets/40/; https://sourceforge.net/projects/webtareas/files/
CVE: CVE-2020-25735
Published: 2020-09-18
Description: webTareas through 2.1 allows XSS in clients/editclient.php, extensions/addextension.php, administration/add_announcement.php, administration/departments.php, administration/locations.php, expenses/claim_type.php, projects/editproject.php, and general/newnotifications.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/%40tehwinsam/webtareas-2-1-c8b406c68c2a; https://sourceforge.net/p/webtareas/tickets/40/; https://sourceforge.net/projects/webtareas/files/