rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-27009 
A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), Nucleus NET (All versions < V5.2), Nucleus Source Code (Versions including affected DNS modules), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). The DNS domain name record decompression functionality does not properly validate the pointer offset values. The parsing of malformed responses could result in a write past the end of an allocated structure. An attacker with a privileged position in the network could leverage this vulnerability to execute code in the context of the current process or cause a denial-of-service condition.
Problem types: cwe_id: CWE-823
description: CWE-823: Use of Out-of-range Pointer Offset
Affected products: vendor: Siemens
product: APOGEE PXC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Compact (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (BACnet)
default_status: unknown
vendor: Siemens
product: APOGEE PXC Modular (P2 Ethernet)
default_status: unknown
vendor: Siemens
product: Nucleus NET
default_status: unknown
vendor: Siemens
product: Nucleus Source Code
default_status: unknown
vendor: Siemens
product: TALON TC Compact (BACnet)
default_status: unknown
vendor: Siemens
product: TALON TC Modular (BACnet)
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
baseScore: 8.1
baseSeverity: HIGH
Published: 2021-04-22T20:42:19.000Z
CVE-2020-27010 
A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper with the web interface of the product in a manner separate from the similar CVE-2020-8462.
Problem types: description: XSS
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Web Security Virtual Appliance
Published: 2020-12-17T21:05:44.000Z
CVE-2020-27013 
Trend Micro Antivirus for Mac 2020 (Consumer) contains a vulnerability in the product that occurs when a webserver is started that implements an API with several properties that can be read and written to allowing the attacker to gather and modify sensitive product and user data. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Improper Access Control Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2020-10-14T15:10:23.000Z
CVE-2020-27014 
Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash.\n\n\r\nAn attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Race Condition
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2020-10-29T23:45:23.000Z
CVE-2020-27015 
Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2020-10-29T23:45:23.000Z
CVE-2020-27016 
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify policy rules by tricking an authenticated administrator into accessing an attacker-controlled web page. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
Published: 2020-11-09T23:10:33.000Z
CVE-2020-27017 
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.
Problem types: description: XXE
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
Published: 2020-11-09T23:10:34.000Z
CVE-2020-27018 
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have obtained authenticated privileges on the product to exploit this vulnerability.
Problem types: description: SSRF
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
Published: 2020-11-09T23:10:34.000Z
CVE-2020-27019 
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an information disclosure vulnerability which could allow an attacker to access a specific database and key.
Problem types: description: Information Disclosure
Affected products: vendor: Trend Micro
product: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)
Published: 2020-11-09T23:10:35.000Z
CVE-2020-27020 
Password generator feature in Kaspersky Password Manager was not completely cryptographically strong and potentially allowed an attacker to predict generated passwords in some cases. An attacker would need to know some additional information (for example, time of password generation).
Problem types: description: Information Disclosure
Affected products: vendor: n/a
product: Kaspersky Password Manager for Windows, Kaspersky Password Manager for Android, Kaspersky Password Manager for iOS
Published: 2021-05-14T11:00:04.000Z
CVE-2020-27021 
In avrc_ctrl_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-168712245
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T15:58:35.000Z
CVE-2020-27023 
In setErrorPlaybackState of BluetoothMediaBrowserService.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156009462
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T15:58:46.000Z
CVE-2020-27024 
In smp_br_state_machine_event of smp_br_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure triggered by a malformed Bluetooth packet, with no additional execution privileges needed. User interaction is not needed for exploitation. Bounds Sanitizer mitigates this in the default configuration.Product: AndroidVersions: Android-11Android ID: A-162327732
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:00:33.000Z
CVE-2020-27025 
In EapFailureNotifier.java and SimRequiredNotifier.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-156008365
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:00:39.000Z
CVE-2020-27026 
During boot, the device unlock interface behaves differently depending on if a fingerprint registered to the device is present. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-79776455
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:00:47.000Z
CVE-2020-27027 
In nfc_ncif_proc_get_routing of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-122358602
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:00:57.000Z
CVE-2020-27028 
In filter_incoming_event of hci_layer.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-141618611
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:01:07.000Z
CVE-2020-27029 
In TextView of TextView.java, there is a possible app hang due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-140218875
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:01:28.000Z
CVE-2020-27030 
In onCreate of HandleApiCalls.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege that allows an app to set or dismiss the alarm with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150612638
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:01:36.000Z
CVE-2020-27031 
In nfc_data_event of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151313205
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:01:43.000Z
CVE-2020-27032 
In getRadioAccessFamily of PhoneInterfaceManager.java, there is a possible read of privileged data due to a missing permission check. This could lead to local information disclosure of radio data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-150857259
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:01:52.000Z
CVE-2020-27033 
In nfc_ncif_proc_get_routing of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153655153
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:02:00.000Z
CVE-2020-27034 
In createSimSelectNotification of SimSelectNotification.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153556754
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:02:08.000Z
CVE-2020-27035 
In priorLinearAllocation of C2AllocatorIon.cpp, there is a possible use-after-free due to improper locking. This could lead to local information disclosure in the media codec with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-152239213
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:02:15.000Z
CVE-2020-27036 
In phNxpNciHal_send_ext_cmd of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the NFC server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153731369
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:03:21.000Z
CVE-2020-27037 
In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the NFC server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153731335
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:03:29.000Z
CVE-2020-27038 
In process of C2SoftVorbisDec.cpp, there is a possible resource exhaustion due to a memory leak. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154302257
Problem types: description: Denial of service
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:03:48.000Z
CVE-2020-27039 
In postNotification of ServiceRecord.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153878498
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:03:59.000Z
CVE-2020-27040 
In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the NFC server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153731880
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:04:05.000Z
CVE-2020-27041 
In showProvisioningNotification of ConnectivityService.java, there is an unsafe PendingIntent. This could lead to local information disclosure of notification data with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-154928507
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:05:10.000Z
CVE-2020-27043 
In nfc_enabled of nfc_main.cc, there is a possible out of bounds read due to an incorrect increment. This could lead to local information disclosure via firmware with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155234594
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:05:18.000Z
CVE-2020-27044 
In restartWrite of Parcel.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157066561
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:05:25.000Z
CVE-2020-27045 
In CE_SendRawFrame of ce_main.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157649398
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:05:32.000Z
CVE-2020-27046 
In nfc_ncif_proc_ee_action of nfc_ncif.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157649306
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:05:38.000Z
CVE-2020-27047 
In ce_t4t_update_binary of ce_t4t.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157649298
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:05:45.000Z
CVE-2020-27048 
In RW_SendRawFrame of rw_main.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157650117
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:05:54.000Z
CVE-2020-27049 
In rw_t3t_send_raw_frame of rw_t3t.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157649467
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:06:15.000Z
CVE-2020-27050 
In rw_i93_send_cmd_write_multi_blocks of rw_i93.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157650365
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:06:21.000Z
CVE-2020-27051 
In NFA_RwI93WriteMultipleBlocks of nfa_rw_api.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157650338
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:06:28.000Z
CVE-2020-27052 
In getLockTaskLaunchMode of ActivityRecord.java, there is a possible way for any app to start in Lock Task Mode due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-158833495
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:06:37.000Z
CVE-2020-27053 
In broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission bypass due to a missing permission check. This could lead to local information disclosure of the WiFi network name with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-159371448
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:06:44.000Z
CVE-2020-27054 
In onFactoryReset of BluetoothManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-159061926
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:06:51.000Z
CVE-2020-27055 
In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, there is a possible insecure WiFi configuration due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-161378819
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:07:36.000Z
CVE-2020-27056 
In SELinux policies of mls, there is a missing permission check. This could lead to local information disclosure of package metadata with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-161356067
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:17:00.000Z
CVE-2020-27057 
In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of gpu statistics with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-161903239
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:17:06.000Z
CVE-2020-27059 
In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069.
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2021-01-11T20:28:56.000Z
CVE-2020-27066 
In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168043318
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2020-12-15T16:17:13.000Z