rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-3912 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Catalina 10.15.4. A local user may be able to cause unexpected system termination or read kernel memory.
Problem types: description: A local user may be able to cause unexpected system termination or read kernel memory
Affected products: vendor: Apple
product: macOS
Published: 2020-04-01T17:53:19.000Z
CVE-2020-3913 
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, watchOS 6.2. A malicious application may be able to elevate privileges.
Problem types: description: A malicious application may be able to elevate privileges
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2020-04-01T17:53:30.000Z
CVE-2020-3914 
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. An application may be able to read restricted memory.
Problem types: description: An application may be able to read restricted memory
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2020-04-01T17:54:00.000Z
CVE-2020-3915 
A path handling issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A malicious application may be able to overwrite arbitrary files.
Problem types: description: A malicious application may be able to overwrite arbitrary files
Affected products: vendor: Apple
product: macOS
Published: 2020-10-22T17:47:34.000Z
CVE-2020-3916 
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, watchOS 6.2. Setting an alternate app icon may disclose a photo without needing permission to access photos.
Problem types: description: Setting an alternate app icon may disclose a photo without needing permission to access photos
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: watchOS
Published: 2020-04-01T17:53:40.000Z
CVE-2020-3917 
This issue was addressed with a new entitlement. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2. An application may be able to use an SSH client provided by private frameworks.
Problem types: description: An application may be able to use an SSH client provided by private frameworks
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2020-04-01T17:54:15.000Z
CVE-2020-3918 
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A local user may be able to view sensitive user information.
Problem types: description: A local user may be able to view sensitive user information
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2020-10-22T17:49:00.000Z
CVE-2020-3919 
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. A malicious application may be able to execute arbitrary code with kernel privileges.
Problem types: description: A malicious application may be able to execute arbitrary code with kernel privileges
Affected products: vendor: Apple
product: iOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2020-04-01T17:54:39.000Z
CVE-2020-3920 Unisoon UltraLog Express - Broken Authentication
UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.
Problem types: description: Broken Authentication
Affected products: vendor: Unisoon
product: UltraLog Express
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2020-03-27T03:50:25.735Z
CVE-2020-3921 Unisoon UltraLog Express - Sensitive Data Exposure
UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.
Problem types: description: Sensitive Data Exposure
Affected products: vendor: Unisoon
product: UltraLog Express
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2020-03-27T03:50:26.138Z
CVE-2020-3922 ArmorX LisoMail - SQL Injection
LisoMail, by ArmorX, allows SQL Injections, attackers can access the database without authentication via a URL parameter manipulation.
Problem types: description: SQL Injection
Affected products: vendor: ArmorX
product: LisoMail
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-03-18T06:40:15.213Z
CVE-2020-3923 TONNET DVR – Broken Access Control
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET, contain misconfigured authentication mechanism. Attackers can crack the default password and gain access to the system.
Problem types: description: Broken Access Control
Affected products: vendor: TONNET
product: DVR
vendor: TONNET
product: DVR
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-02-27T04:00:31.892Z
CVE-2020-3924 TONNET DVR – Firmware Injection
DVR firmware in TAT-76 and TAT-77 series of products, provided by TONNET do not properly verify patch files. Attackers can inject a specific command into a patch file and gain access to the system.
Problem types: description: Firmware Injection
Affected products: vendor: TONNET
product: DVR
vendor: TONNET
product: DVR
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-02-27T04:00:32.289Z
CVE-2020-3925 ServiSign Windows Versions- Remote Code Execution via  LoadLibrary
A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.
Problem types: description: Remote Code Execution
Affected products: vendor: CHANGING
product: ServiSign Windows versions
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-02-03T11:00:30.831Z
CVE-2020-3926 ServiSign Windows Versions- Arbitrary File  Access
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
Problem types: description: Arbitrary File Access
Affected products: vendor: CHANGING
product: ServiSign Windows versions
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
version: 3.1
Published: 2020-02-03T11:00:31.233Z
CVE-2020-3927 ServiSign Windows Versions- Arbitrary File  Deletion
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.
Problem types: description: Arbitrary File Deletion
Affected products: vendor: CHANGING
product: ServiSign Windows versions
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-02-03T11:00:31.635Z
CVE-2020-3928 GeoVision Door Access Control Device - Hardcoded privileged password
GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.
Problem types: description: Hardcoded privileged password
Affected products: vendor: GeoVision
product: Door Access Control Device
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-06-12T08:25:23.055Z
CVE-2020-3929 GeoVision Door Access Control Device - Shared cryptographic keys
GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages.
Problem types: description: Shared cryptographic keys
Affected products: vendor: GeoVision
product: Door Access Control Device
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-06-12T08:25:23.476Z
CVE-2020-3930 GeoVision Door Access Control Device - Information disclosure vulnerability
GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.
Problem types: description: Information disclosure vulnerability
Affected products: vendor: GeoVision
product: Door Access Control Device
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2020-06-12T08:25:23.937Z
CVE-2020-3931 GeoVision Door Access Control Device - Buffer overflow vulnerability
Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.
Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Overflow
Affected products: vendor: GeoVision
product: Door Access Control Device
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-07-08T10:05:21.030Z
CVE-2020-3932 Draytek VigorAP910C - Information Leakage
A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.
Problem types: description: Information Leakage
Affected products: vendor: DRAYTEK CORP.
product: VigorAP910C
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-04-15T06:20:24.488Z
CVE-2020-3933 TAIWAN SECOM CO., LTD. - User Account Enumeration
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user account in the system.
Problem types: description: User Account Enumeration
Affected products: vendor: TAIWAN SECOM CO., LTD.
product: Door Access Control system
vendor: TAIWAN SECOM CO., LTD.
product: Personnel Attendance system
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2020-02-11T08:00:29.196Z
CVE-2020-3934 TAIWAN SECOM CO., LTD. - Pre-auth SQL Injection
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection, allowing attackers to inject a specific SQL command.
Problem types: description: Pre-auth SQL Injection
Affected products: vendor: TAIWAN SECOM CO., LTD.
product: Door Access Control system
vendor: TAIWAN SECOM CO., LTD.
product: Personnel Attendance system
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-02-11T08:00:29.639Z
CVE-2020-3935 TAIWAN SECOM CO., LTD. – Sensitivity Information Exposure
TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cookie, which divulges password to attackers.
Problem types: description: Sensitivity Information Exposure
Affected products: vendor: TAIWAN SECOM CO., LTD.
product: Door Access Control system
vendor: TAIWAN SECOM CO., LTD.
product: Personnel Attendance system
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2020-02-11T08:00:30.076Z
CVE-2020-3936 Unisoon UltraLog Express - SQL Injection
UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unisoon
product: UltraLog Express
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2020-03-27T03:50:26.586Z
CVE-2020-3937 SysJust Syuan-Gu-Da-Shih-SQL injection
SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary file in the database.
Problem types: description: SQL-injection
Affected products: vendor: CHANGING
product: Syuan-Gu-Da-Shih
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-02-04T04:15:21.658Z
CVE-2020-3938 SysJust Syuan-Gu-Da-Shih -Request-Forgery
SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into network architecture or system files of the server via forged inquests.
Problem types: description: Request-Forgery
Affected products: vendor: CHANGING
product: Syuan-Gu-Da-Shih
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2020-02-04T04:15:22.050Z
CVE-2020-3939 SysJust Syuan-Gu-Da-Shih -Cross-Site Scripting(XSS)
SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked to attackers via the vulnerability.
Problem types: description: Request-Forgery
Affected products: vendor: CHANGING
product: Syuan-Gu-Da-Shih
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2020-02-04T04:15:22.493Z
CVE-2020-3940 
VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability.
Problem types: description: Sensitive information disclosure
Affected products: vendor: VMware
product: Workspace ONE SDK
Published: 2020-01-17T17:59:29.000Z
CVE-2020-3941 
The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is installed. This vulnerability is not present in VMware Tools 11.x.y since the affected functionality is not present in VMware Tools 11.
Problem types: description: VMware Tools privilege escalation vulnerability
Affected products: vendor: VMware
product: VMware Tools for Windows (VMware Tools)
Published: 2020-01-15T19:03:19.000Z
CVE-2020-3943 
vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to execute arbitrary code in vRealize Operations.
Problem types: description: Remote code execution vulnerability
Affected products: vendor: VMWare
product: vRealize Operations for Horizon Adapter
Published: 2020-02-19T20:04:00.000Z
CVE-2020-3944 
vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) has an improper trust store configuration leading to authentication bypass. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to bypass Adapter authentication.
Problem types: description: Authentication bypass vulnerability
Affected products: vendor: VMWare
product: vRealize Operations for Horizon Adapter
Published: 2020-02-19T20:03:57.000Z
CVE-2020-3945 
vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) contains an information disclosure vulnerability due to incorrect pairing implementation between the vRealize Operations for Horizon Adapter and Horizon View. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may obtain sensitive information
Problem types: description: Information disclosure vulnerability
Affected products: vendor: VMWare
product: vRealize Operations for Horizon Adapter
Published: 2020-02-19T20:03:54.000Z
CVE-2020-3946 
InstallBuilder AutoUpdate tool and regular installers enabling <checkForUpdates> built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).
Problem types: description: n/a
Affected products: vendor: VMware
product: InstallBuilder
Published: 2020-04-20T19:06:54.000Z
CVE-2020-3947 
VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a use-after vulnerability in vmnetdhcp. Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition of the vmnetdhcp service running on the host machine.
Problem types: description: Use-after-free vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2020-03-16T17:21:09.000Z
CVE-2020-3948 
Linux Guest VMs running on VMware Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a local privilege escalation vulnerability due to improper file permissions in Cortado Thinprint. Local attackers with non-administrative access to a Linux guest VM with virtual printing enabled may exploit this issue to elevate their privileges to root on the same guest VM.
Problem types: description: Local privilege escalation vulnerability
Affected products: vendor: VMware
product: Workstation
vendor: VMware
product: Fusion
Published: 2020-03-16T17:17:39.000Z
CVE-2020-3950 
VMware Fusion (11.x before 11.5.2), VMware Remote Console for Mac (11.x and prior before 11.0.1) and Horizon Client for Mac (5.x and prior before 5.4.0) contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC or Horizon Client is installed.
Problem types: description: Privilege escalation vulnerability
Affected products: vendor: n/a
product: VMware Fusion, VMware Remote Console for Mac and Horizon Client for Mac
Published: 2020-03-17T18:41:52.000Z
CVE-2020-3951 
VMware Workstation (15.x before 15.5.2) and Horizon Client for Windows (5.x and prior before 5.4.0) contain a denial-of-service vulnerability due to a heap-overflow issue in Cortado Thinprint. Attackers with non-administrative access to a guest VM with virtual printing enabled may exploit this issue to create a denial-of-service condition of the Thinprint service running on the system where Workstation or Horizon Client is installed.
Problem types: description: Denial-of-service vulnerability
Affected products: vendor: n/a
product: VMware Workstation and Horizon Client for Windows
Published: 2020-03-17T18:41:49.000Z
CVE-2020-3952 
Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.
Problem types: description: Critical Information Disclosure
Affected products: vendor: n/a
product: VMware vCenter Server
Published: 2020-04-10T13:55:36.000Z
CVE-2020-3953 
Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.
Problem types: description: Stored XSS
Affected products: vendor: n/a
product: VMware vRealize Log Insight
Published: 2020-04-15T17:20:09.000Z
CVE-2020-3954 
Open Redirect vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.
Problem types: description: Stored XSS
Affected products: vendor: n/a
product: VMware vRealize Log Insight
Published: 2020-04-15T17:17:17.000Z