rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-15679 
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions. This vulnerability affects Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2, and Mozilla VPN Android 1.1.0 < (1360).
Problem types: description: OAuth Session Fixation on VPN login
Affected products: vendor: Mozilla
product: Mozilla VPN iOS 1.0.7
vendor: Mozilla
product: Mozilla VPN Windows
vendor: Mozilla
product: Mozilla VPN Android 1.1.0
Published: 2022-12-22T00:00:00.000Z
CVE-2020-15680 
If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerability affects Firefox < 82.
Problem types: description: Presence of external protocol handlers could be determined through image tags
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-22T20:32:46.000Z
CVE-2020-15681 
When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 82.
Problem types: description: Multiple WASM threads may have overwritten each others' stub table entries
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-22T20:32:37.000Z
CVE-2020-15682 
When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.
Problem types: description: The domain associated with the prompt to open an external protocol could be spoofed to display the incorrect origin
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-22T20:32:25.000Z
CVE-2020-15683 
Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.
Problem types: description: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4
Affected products: vendor: Mozilla
product: Firefox ESR
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Thunderbird
Published: 2020-10-22T20:32:14.000Z
CVE-2020-15684 
Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82.
Problem types: description: Memory safety bugs fixed in Firefox 82
Affected products: vendor: Mozilla
product: Firefox
Published: 2020-10-22T20:31:33.000Z
CVE-2020-15685 
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
Problem types: description: IMAP Response Injection when using STARTTLS
Affected products: vendor: Mozilla
product: Thunderbird
Published: 2022-12-22T00:00:00.000Z
CVE-2020-15687 
Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root access in the Service VM userspace, to abuse the PCIe assign/de-assign Hypercalls via crafted ioctls and payloads. This attack results in a corrupt state and Denial of Service (DoS) for previously assigned PCIe devices to the Service VM at runtime.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-31T15:39:24.000Z
CVE-2020-15688 
The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-23T12:32:37.000Z
CVE-2020-15689 
Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact range. This may result in a NULL pointer dereference and cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-13T13:48:39.000Z
CVE-2020-15690 
In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-30T05:12:58.000Z
CVE-2020-15692 
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-14T18:45:35.000Z
CVE-2020-15693 
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call (such as httpClient.get or httpClient.post), the User-Agent header value, or custom HTTP header names or values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-14T18:47:01.000Z
CVE-2020-15694 
In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() does not raise any error if a malicious server provides a negative Content-Length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-14T18:48:45.000Z
CVE-2020-15695 
An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T15:50:00.000Z
CVE-2020-15696 
An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T15:50:29.000Z
CVE-2020-15697 
An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T15:50:58.000Z
CVE-2020-15698 
An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credentials
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T15:51:37.000Z
CVE-2020-15699 
An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T15:52:07.000Z
CVE-2020-15700 
An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T15:52:30.000Z
CVE-2020-15701 Unhandled exception in apport
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, 2.20.11-0ubuntu27.6.
Problem types: cwe_id: CWE-755
description: CWE-755 Improper Handling of Exceptional Conditions
Affected products: vendor: Canonical
product: apport
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Seong-Joong Kim
Published: 2020-08-06T22:50:22.407Z
CVE-2020-15702 TOCTOU in apport
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Canonical
product: apport
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Ryota Shiga
Published: 2020-08-06T22:50:22.871Z
CVE-2020-15703 aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Canonical
product: aptdaemon
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Vaisha Bernard
Published: 2020-10-31T03:45:19.526Z
CVE-2020-15704 pppd arbitrary file read information disclosure vulnerability
The modprobe child process in the ./debian/patches/load_ppp_generic_if_needed patch file incorrectly handled module loading. A local non-root attacker could exploit the MODPROBE_OPTIONS environment variable to read arbitrary root files. Fixed in 2.4.5-5ubuntu1.4, 2.4.5-5.1ubuntu2.3+esm2, 2.4.7-1+2ubuntu1.16.04.3, 2.4.7-2+2ubuntu1.3, 2.4.7-2+4.1ubuntu5.1, 2.4.7-2+4.1ubuntu6. Was ZDI-CAN-11504.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Exposure
Affected products: vendor: Canonical
product: ppp
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Thomas Chauchefoin working with Trend Micro's Zero Day Initiative
Published: 2020-08-31T23:15:14.261Z
CVE-2020-15705 GRUB2: avoid loading unsigned kernels when GRUB is booted directly under secureboot without shim
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Ubuntu
product: grub2 in Ubuntu
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mathieu Trudel-Lapierre
Published: 2020-07-29T17:45:33.422Z
CVE-2020-15706 GRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
Problem types: cwe_id: CWE-362
description: CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)
Affected products: vendor: Ubuntu
product: grub2 in Ubuntu
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Chris Coulson
Published: 2020-07-29T17:45:33.975Z
CVE-2020-15707 GRUB2 contained integer overflows when handling the initrd command, leading to a heap-based buffer overflow.
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
Problem types: cwe_id: CWE-362
description: CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)
Affected products: vendor: Ubuntu
product: grub2 in Ubuntu
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: Colin Watson
lang: en
value: Chris Coulson
Published: 2020-07-29T17:45:34.577Z
CVE-2020-15708 Libvirt Service Arbitrary File Write Privilege Escalation Vulnerability
Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Ubuntu
product: libvirt
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Trent Shea
Published: 2020-11-06T01:40:13.864Z
CVE-2020-15709 add-apt-repository print ASNI terminal codes
Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal contents in unexpected ways.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Canonical
product: add-apt-repository
Credits: lang: en
value: Jason A. Donenfeld
Published: 2020-09-05T03:30:18.015Z
CVE-2020-15710 Potential double-free in pulseaudio
Potential double free in Bluez 5 module of PulseAudio could allow a local attacker to leak memory or crash the program. The modargs variable may be freed twice in the fail condition in src/modules/bluetooth/module-bluez5-device.c and src/modules/bluetooth/module-bluez5-device.c. Fixed in 1:8.0-0ubuntu3.14.
Problem types: cwe_id: CWE-415
description: CWE-415 Double Free
Affected products: vendor: Canonical
product: PulseAudio
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
version: 3.1
Credits: lang: en
value: Ratchanan Srirattanamet
Published: 2020-11-19T02:30:17.080Z
CVE-2020-15711 
In MISP before 2.4.129, setting a favourite homepage was not CSRF protected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T12:05:48.000Z
CVE-2020-15712 
rConfig 3.9.5 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a crafted request to the ajaxGetFileByPath.php script containing hexadecimal encoded "dot dot" sequences (%2f..%2f) in the path parameter to view arbitrary files on the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T13:03:09.000Z
CVE-2020-15713 
rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.php script using the sortBy parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T13:03:37.000Z
CVE-2020-15714 
rConfig 3.9.5 is vulnerable to SQL injection. A remote authenticated attacker could send crafted SQL statements to the devices.crud.php script using the custom_Location parameter, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T13:03:52.000Z
CVE-2020-15715 
rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system, because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-28T13:04:09.000Z
CVE-2020-15716 
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Preferences.php script. A remote attacker could exploit this vulnerability using the tab parameter in a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T19:00:44.000Z
CVE-2020-15717 
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the Search.inc.php script. A remote attacker could exploit this vulnerability using the advanced parameter in a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T19:01:43.000Z
CVE-2020-15718 
RosarioSIS 6.7.2 is vulnerable to XSS, caused by improper validation of user-supplied input by the PrintSchedules.php script. A remote attacker could exploit this vulnerability using the include_inactive parameter in a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-15T19:02:52.000Z
CVE-2020-15719 
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:47:31.000Z
CVE-2020-15720 
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T13:46:58.000Z
CVE-2020-15721 
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-14T14:26:43.000Z
CVE-2020-15722 
In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking could execute arbitrary code on the Local system.
Problem types: description: local privilege escalation vulnerability
Affected products: vendor: n/a
product: 360 Total Security
Published: 2020-07-21T17:10:21.000Z
CVE-2020-15723 
In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking to bypass the hips could execute arbitrary code on the Local system.
Problem types: description: local privilege escalation vulnerability
Affected products: vendor: n/a
product: 360 Total Security
Published: 2020-07-21T17:04:50.000Z
CVE-2020-15724 
In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking to bypass the hips could execute arbitrary code on the Local system.
Problem types: description: local privilege escalation vulnerability
Affected products: vendor: n/a
product: 360 Total Security
Published: 2020-07-21T17:36:16.000Z
CVE-2020-15731 Local Privilege Escalation in Bitdefender Engines (VA-8953)
An improper Input Validation vulnerability in the code handling file renaming and recovery in Bitdefender Engines allows an attacker to write an arbitrary file in a location hardcoded in a specially-crafted malicious file name. This issue affects: Bitdefender Engines versions prior to 7.85448.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Bitdefender
product: Bitdefender Engines
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: HOU JINGYI
Published: 2020-09-30T11:55:18.065Z