yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-12830: Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code execution in Western Digital My Cloud devices before 5.04.114.
Key phrases: carry out escalation of privileges through unauthorized remote, stack buffer overflow, escalation privilege, remote code execution
CVE-2020-12831: An issue was discovered in FRRouting FRR (aka Free Range Routing) through 7.3.1. When using the split-config feature, the init script creates an empty config file with world-readable default permissions, leading to a possible information leak via tools/frr.in and tools/frrcommon.sh.in. NOTE: some parties consider this user error, not a vulnerability, because the permissions are under the control of the user before any sensitive information is present in the file
Key phrases: information leak, sensitive information
CVE-2020-12832: WordPress Plugin Simple File List before 4.2.8 is prone to a vulnerability that lets attackers delete arbitrary files because the application fails to properly verify user-supplied input.
Key phrases: delete arbitrary files
CVE-2020-12834: eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup (or factory reset).
Key phrases: the web interface, remote code execution
CVE-2020-12835: An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component.
Key phrases: unsafe configuration, remote code execution
CVE-2020-12837: ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors. The magic bytes of PNG must be used.
Key phrases: malicious file uploads, magic bytes of png
CVE-2020-12838: ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php.
Key phrases: privilege escalation
CVE-2020-12839: ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.php.
Key phrases: privilege escalation
CVE-2020-1284: A denial of service vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Denial of Service Vulnerability'.
Key phrases: denial of service
CVE-2020-12840: ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php
Key phrases: upload sound files via /index.php, csrf
CVE-2020-12841: ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php
Key phrases: upload imae files via /index.php, csrf
CVE-2020-12842: ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationDate.php.
Key phrases: privilege escalation
CVE-2020-12843: ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors. The magic bytes for WAV must be used.
Key phrases: malicious file uploads, magic bytes
CVE-2020-12845: Cherokee 0.4.27 to 1.2.104 is affected by a denial of service due to a NULL pointer dereferences. A remote unauthenticated attacker can crash the server by sending an HTTP request to protected resources using a malformed Authorization header that is mishandled during a cherokee_buffer_add call within cherokee_validator_parse_basic or cherokee_validator_parse_digest.
Key phrases: denial of service, null pointer dereferences, crash
CVE-2020-12846: Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.
Key phrases: possible remote execution, remote code execution, file upload
CVE-2020-12847: Pydio Cells 2.0.4 web application offers an administrative console named Cells Console that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the applications mailer configuration. It is possible to configure a few engines to be used by the mailer application to send emails. If the user selects the sendmail option as the default one, the web application offers to edit the full path where the sendmail binary is hosted. Since there is no restriction in place while editing this value, an attacker authenticated as an administrator user could force the web application into executing any arbitrary binary.
Key phrases: arbitrary binary, execute arbitrary
CVE-2020-12848: In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and proceed to login to the web application. Once logged into the web application with the hidden user account, some actions that were not available with the public share link can now be performed.
CVE-2020-12849: Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user.
Key phrases: upload a profile image to the web application
CVE-2020-1285: <p>A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p><p>There are multiple ways an attacker could exploit the vulnerability:</p><ul><li>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to open an email attachment or click a link in an email or instant message.</li><li>In a file-sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit the vulnerability, and then convince users to open the document file.</li></ul><p>The security update addresses the vulnerability by correcting the way that the Windows GDI handles objects in the memory.</p>
Key phrases: remote code execution, web-based attack scenario, file-sharing attack scenario, convince
CVE-2020-12850: The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser policy restriction allowing the pydio user to execute any privileged command using sudo. In version 2.0.4 of the appliance, the user pydio is responsible for running all the services and binaries that are contained in the Pydio Cells web application package, such as mysqld, cells, among others. This user has privileges restricted to run those services and nothing more.
Key phrases: execute any privileged command using sudo
CVE-2020-12851: Pydio Cells 2.0.4 allows an authenticated user to write or overwrite existing files in another users personal and cells folders (repositories) by uploading a custom generated ZIP file and leveraging the file extraction feature present in the web application. The extracted files will be placed in the targeted user folders.
Key phrases: write or overwrite existing files in another users
CVE-2020-12852: The update feature for Pydio Cells 2.0.4 allows an administrator user to set a custom update URL and the public RSA key used to validate the downloaded update package. The update process involves downloading the updated binary file from a URL indicated in the update server response, validating its checksum and signature with the provided public key and finally replacing the current application binary. To complete the update process, the applications service or appliance needs to be restarted. An attacker with administrator access can leverage the software update feature to force the application to download a custom binary that will replace current Pydio Cells binary. When the server or service is eventually restarted the attacker will be able to execute code under the privileges of the user running the application. In the Pydio Cells enterprise appliance this is with the privileges of the user named pydio.
Key phrases: set a custom update URL and the public, execute code
CVE-2020-12853: Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal folders or accessible cells.
Key phrases: personal folders or accessible cells, xss
CVE-2020-12854: A remote code execution vulnerability was identified in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can invoke code execution upon uploading a carefully crafted JPEG file as part of the profile avatar.
Key phrases: remote code execution
CVE-2020-12855: A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an adversary controlling the execution flow for the 302 HTTP status.
Key phrases: host header injection
CVE-2020-12856: OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used.
Key phrases: conduct long-term re-identification attacks, unspecified other impact, unspecified impact
CVE-2020-12857: Caching of GATT characteristic values (TempID) in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COVIDSafe.
Key phrases: long-term re-identify an Android, caching of gatt characteristic values (tempid)
CVE-2020-12858: Non-reinitialisation of random data in the advertising payload in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to re-identify Android devices running COVIDSafe by scanning for their advertising beacons.
Key phrases: re-identify Android devices running COVIDSafe by, non-reinitialisation of random data
CVE-2020-12859: Unnecessary fields in the OpenTrace/BlueTrace protocol in COVIDSafe through v1.0.17 allow a remote attacker to identify a device model by observing cleartext payload data. This allows re-identification of devices, especially less common phone models or those in low-density situations.
Key phrases: identify a device model by observing cleartext payload, re-identification of devices, low-density situations
CVE-2020-1286: A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user, aka 'Windows Shell Remote Code Execution Vulnerability'.
Key phrases: run arbitrary code, remote code execution
CVE-2020-12860: COVIDSafe through v1.0.17 allows a remote attacker to access phone name and model information because a BLE device can have four roles and COVIDSafe uses all of them. This allows for re-identification of a device, and potentially identification of the owner's name.
Key phrases: access phone name and model information because a, for re-identification of a device
CVE-2020-12861: A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-080.
Key phrases: execute arbitrary code, the same local network as the victim to, heap buffer overflow
CVE-2020-12862: An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-082.
Key phrases: the same local network as the victim to, out-of-bounds read, out of bounds read
CVE-2020-12863: An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-083.
Key phrases: the same local network as the victim to, out-of-bounds read, out of bounds read
CVE-2020-12864: An out-of-bounds read in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to read important information, such as the ASLR offsets of the program, aka GHSL-2020-081.
Key phrases: the same local network as the victim to, out-of-bounds read, out of bounds read
CVE-2020-12865: A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to execute arbitrary code, aka GHSL-2020-084.
Key phrases: execute arbitrary code, the same local network as the victim to, heap buffer overflow
CVE-2020-12866: A NULL pointer dereference in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, GHSL-2020-079.
Key phrases: the same local network as the victim to, null pointer dereference, denial of service
CVE-2020-12867: A NULL pointer dereference in sanei_epson_net_read in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to cause a denial of service, aka GHSL-2020-075.
Key phrases: the same local network as the victim to, null pointer dereference, denial of service
CVE-2020-12869: RainbowFish PacsOne Server 6.8.4 allows XSS.
Key phrases: XSS, xss
CVE-2020-1287: An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1294.
Key phrases: elevation of privilege, windows walletservice elevation of privilege, elevation privilege
CVE-2020-12870: RainbowFish PacsOne Server 6.8.4 allows SQL injection on the username parameter in the signup page.
Key phrases: SQL injection on the username parameter in the, sql injection
CVE-2020-12872: yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.
Key phrases: Sweet32 attacks
CVE-2020-12873: An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (e.g., a webscript) may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco.
Key phrases: execute arbitrary Java code
CVE-2020-12874: Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication credentials were provided to the server.
CVE-2020-12875: Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. An authenticated user could gain unauthorized access to sensitive information or functionality by manipulating specific parameters within the application.
Key phrases: gain unauthorized access, access sensitive information
CVE-2020-12876: Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server. This vulnerability only impacts Windows server deployments.
Key phrases: unintended files, windows server deployments
CVE-2020-12877: Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication.
Key phrases: accessible without authentication, sensitive information
CVE-2020-12878: Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory.
Key phrases: escalate privileges from the python user to root, symlink
CVE-2020-12880: An issue was discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and can be retrieved. (The source code is otherwise inaccessible because the appliance has its hard disks encrypted, and no root shell is available during normal operation.)
Key phrases: root shell
CVE-2020-12882: Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow.
Key phrases: XSS via upload of an SVG document, xss
CVE-2020-12883: Buffer over-reads were discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the option delta and option length bytes. The actual input packet length is not verified against the number of bytes read when processing the option extended delta and the option extended length. Moreover, the calculation of the message_left variable, in the case of non-extended option deltas, is incorrect and indicates more data left for processing than provided in the function input. All of these lead to heap-based or stack-based memory location read access that is outside of the intended boundary of the buffer. Depending on the platform-specific memory management mechanisms, it can lead to processing of unintended inputs or system memory access violation errors.
Key phrases: buffer over-reads, system memory access violation errors
CVE-2020-12884: A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse_multiple_options() parses CoAP options that may occur multiple consecutive times in a single packet. While processing the options, packet_data_pptr is accessed after being incremented by option_len without a prior out-of-bounds memory check. The temp_parsed_uri_query_ptr is validated for a correct range, but the range valid for temp_parsed_uri_query_ptr is derived from the amount of allocated heap memory, not the actual input size. Therefore the check of temp_parsed_uri_query_ptr may be insufficient for safe access to the area pointed to by packet_data_pptr. As a result, access to a memory area outside of the intended boundary of the packet buffer is made.
Key phrases: buffer over-read, buffer over read, out of bounds memory
CVE-2020-12885: An infinite loop was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse_multiple_options() parses CoAP options in a while loop. This loop's exit condition is computed using the previously allocated heap memory required for storing the result of parsing multiple options. If the input heap memory calculation results in zero bytes, the loop exit condition is never met and the loop is not terminated. As a result, the packet parsing function never exits, leading to resource consumption.
Key phrases: infinite loop, resource consumption
CVE-2020-12886: A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the CoAP packet header starting from the message token. The length of the token in the received message is provided in the first byte parsed by the sn_coap_parser_options_parse() function. The length encoded in the message is not validated against the actual input buffer length before accessing the token. As a result, memory access outside of the intended boundary of the buffer may occur.
Key phrases: buffer over-read, memory access, buffer over read
CVE-2020-12887: Memory leaks were discovered in the CoAP library in Arm Mbed OS 5.15.3 when using the Arm mbed-coap library 5.1.5. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses the CoAP option number field of all options present in the input packet. Each option number is calculated as a sum of the previous option number and a delta of the current option. The delta and the previous option number are expressed as unsigned 16-bit integers. Due to lack of overflow detection, it is possible to craft a packet that wraps the option number around and results in the same option number being processed again in a single packet. Certain options allocate memory by calling a memory allocation function. In the cases of COAP_OPTION_URI_QUERY, COAP_OPTION_URI_PATH, COAP_OPTION_LOCATION_QUERY, and COAP_OPTION_ETAG, there is no check on whether memory has already been allocated, which in conjunction with the option number integer overflow may lead to multiple assignments of allocated memory to a single pointer. This has been demonstrated to lead to memory leak by buffer orphaning. As a result, the memory is never freed.
Key phrases: memory leaks, buffer orphaning, integer overflow
CVE-2020-12888: The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles attempts to access disabled memory space.
Key phrases: disabled memory space
CVE-2020-12889: MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.
Key phrases: misp connection
CVE-2020-1289: A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-1148.
Key phrases: spoofing, microsoft sharepoint spoofing
CVE-2020-12890: Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture (AGESA) to execute arbitrary code undetected by the operating system.
Key phrases: execute arbitrary code, potentially manipulate the AMD Generic Encapsulated Software Architecture, improper handling of pointers
CVE-2020-12891: AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location which is in path environment variable.
Key phrases: dll hijacking
CVE-2020-12892: An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execution.
Key phrases: untrusted search path, privilege escalation, unauthorized code execution
CVE-2020-12893: Stack Buffer Overflow in AMD Graphics Driver for Windows 10 in Escape 0x15002a may lead to escalation of privilege or denial of service.
Key phrases: stack buffer overflow, escalation of privilege, denial of service, escalation privilege
CVE-2020-12894: Arbitrary Write in AMD Graphics Driver for Windows 10 in Escape 0x40010d may lead to arbitrary write to kernel memory or denial of service.
Key phrases: arbitrary write, escape, denial of service
CVE-2020-12895: Pool/Heap Overflow in AMD Graphics Driver for Windows 10 in Escape 0x110037 may lead to escalation of privilege, information disclosure or denial of service.
Key phrases: pool heap overflow, escalation of privilege, information disclosure, denial of service, escalation privilege
CVE-2020-12897: Kernel Pool Address disclosure in AMD Graphics Driver for Windows 10 may lead to KASLR bypass.
Key phrases: KASLR bypass, kernel pool address disclosure, kaslr bypass
CVE-2020-12898: Stack Buffer Overflow in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
Key phrases: stack buffer overflow, escalation of privilege, denial of service, escalation privilege
CVE-2020-12899: Arbitrary Read in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or denial of service.
Key phrases: bypass or denial of service, KASLR bypass, arbitrary read, kaslr bypass
CVE-2020-1290: An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.
Key phrases: information disclosure
CVE-2020-12900: An arbitrary write vulnerability in the AMD Radeon Graphics Driver for Windows 10 potentially allows unprivileged users to gain Escalation of Privileges and cause Denial of Service.
Key phrases: gain Escalation, gain Escalation of Privileges and cause Denial of, arbitrary write, denial of service
CVE-2020-12901: Arbitrary Free After Use in AMD Graphics Driver for Windows 10 may lead to KASLR bypass or information disclosure.
Key phrases: bypass or information disclosure, KASLR bypass, kaslr bypass
CVE-2020-12902: Arbitrary Decrement Privilege Escalation in AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
Key phrases: arbitrary decrement privilege escalation, escalation of privilege, denial of service, escalation privilege
CVE-2020-12903: Out of Bounds Write and Read in AMD Graphics Driver for Windows 10 in Escape 0x6002d03 may lead to escalation of privilege or denial of service.
Key phrases: out of bounds write, escape, escalation of privilege, denial of service, escalation privilege
CVE-2020-12904: Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004203 may lead to arbitrary information disclosure.
Key phrases: out of bounds read, arbitrary information disclosure
CVE-2020-12905: Out of Bounds Read in AMD Graphics Driver for Windows 10 in Escape 0x3004403 may lead to arbitrary information disclosure.
Key phrases: out of bounds read, arbitrary information disclosure
CVE-2020-1291: An elevation of privilege vulnerability exists in the way that the Windows Network Connections Service handles objects in memory, aka 'Windows Network Connections Service Elevation of Privilege Vulnerability'.
Key phrases: elevation of privilege, windows network connections service elevation of privilege, elevation privilege
CVE-2020-12911: A denial of service vulnerability exists in the D3DKMTCreateAllocation handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A specially crafted D3DKMTCreateAllocation API request can cause an out-of-bounds read and denial of service (BSOD). This vulnerability can be triggered from a non-privileged account.
Key phrases: denial of service (BSOD), out-of-bounds read, denial of service (bsod), out of bounds read
CVE-2020-12912: A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require privileged access.
Key phrases: use the Linux-based Running Average Power, side channel
CVE-2020-1292: An elevation of privilege vulnerability exists in OpenSSH for Windows when it does not properly restrict access to configuration settings, aka 'OpenSSH for Windows Elevation of Privilege Vulnerability'.
Key phrases: elevation of privilege, elevation privilege
CVE-2020-12920: A potential denial of service issue exists in the AMD Display driver Escape 0x130007 Call handler. An attacker with low privilege could potentially induce a Windows BugCheck.
Key phrases: denial of service issue
CVE-2020-12926: The Trusted Platform Modules (TPM) reference software may not properly track the number of times a failed shutdown happens. This can leave the TPM in a state where confidential key material in the TPM may be able to be compromised. AMD believes that the attack requires physical access of the device because the power must be repeatedly turned on and off. This potential attack may be used to change confidential information, alter executables signed by key material in the TPM, or create a denial of service of the device.
Key phrases: failed shutdown, denial of service, confidential information
CVE-2020-12927: A potential vulnerability in a dynamically loaded AMD driver in AMD VBIOS Flash Tool SDK may allow any authenticated user to escalate privileges to NT authority system.
Key phrases: escalate privileges to NT authority system
CVE-2020-12928: A vulnerability in a dynamically loaded AMD driver in AMD Ryzen Master V15 may allow any authenticated user to escalate privileges to NT authority system.
Key phrases: escalate privileges to NT authority system
CVE-2020-12929: Improper parameters validation in some trusted applications of the PSP contained in the AMD Graphics Driver may allow a local attacker to bypass security restrictions and achieve arbitrary code execution .
Key phrases: achieve arbitrary code execution, bypass security restrictions, bypass security restrictions and achieve arbitrary code execution, improper parameters validation
CVE-2020-1293: An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly handles file operations, aka 'Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1257, CVE-2020-1278.
Key phrases: elevation of privilege, diagnostics hub standard collector elevation of privilege, elevation privilege
CVE-2020-12930: Improper parameters handling in AMD Secure Processor (ASP) drivers may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity.
Key phrases: elevate their privileges potentially leading to loss of, improper parameters handling, loss of integrity, elevate privileges
CVE-2020-12931: Improper parameters handling in the AMD Secure Processor (ASP) kernel may allow a privileged attacker to elevate their privileges potentially leading to loss of integrity.
Key phrases: elevate their privileges potentially leading to loss of, improper parameters handling, loss of integrity, elevate privileges
CVE-2020-12933: A denial of service vulnerability exists in the D3DKMTEscape handler functionality of AMD ATIKMDAG.SYS (e.g. version 26.20.15029.27017). A specially crafted D3DKMTEscape API request can cause an out-of-bounds read in Windows OS kernel memory area. This vulnerability can be triggered from a non-privileged account.
Key phrases: denial of service, out-of-bounds read, out of bounds read
CVE-2020-1294: An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletService Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1287.
Key phrases: elevation of privilege, windows walletservice elevation of privilege, elevation privilege
CVE-2020-12944: Insufficient validation of BIOS image length by ASP Firmware could lead to arbitrary code execution.
Key phrases: insufficient validation, arbitrary code execution
CVE-2020-12946: Insufficient input validation in ASP firmware for discrete TPM commands could allow a potential loss of integrity and denial of service.
Key phrases: a potential loss of integrity and denial of, insufficient input validation, denial of service
CVE-2020-1295: An elevation of privilege vulnerability exists in Microsoft SharePoint, aka 'Microsoft SharePoint Elevation of Privilege Vulnerability'.
Key phrases: elevation of privilege, microsoft sharepoint elevation of privilege, elevation privilege
CVE-2020-12951: Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations.
Key phrases: perform ASP SMM (System Management Mode), race condition
CVE-2020-12954: A side effect of an integrated chipset option may be able to be used by an attacker to bypass SPI ROM protections, allowing unauthorized SPI ROM modification.
Key phrases: bypass SPI ROM protections, unauthorized SPI ROM modification, side effect, unauthorized spi rom modification
CVE-2020-1296: A vulnerability exists in the way the Windows Diagnostics &amp; feedback settings app handles objects in memory, aka 'Windows Diagnostics & feedback Information Disclosure Vulnerability'.
Key phrases: windows diagnostics & feedback information disclosure
CVE-2020-12960: AMD Graphics Driver for Windows 10, amdfender.sys may improperly handle input validation on InputBuffer which may result in a denial of service (DoS).
Key phrases: denial of service (DoS), denial of service (dos)
CVE-2020-12961: A potential vulnerability exists in AMD Platform Security Processor (PSP) that may allow an attacker to zero any privileged register on the System Management Network which may lead to bypassing SPI ROM protections.
Key phrases: zero any privileged register on the System Management
CVE-2020-12962: Escape call interface in the AMD Graphics Driver for Windows may cause privilege escalation.
Key phrases: escape call interface, privilege escalation
CVE-2020-12963: An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows may allow unprivileged users to compromise the system.
Key phrases: compromise the system, insufficient pointer validation
CVE-2020-12964: A potential privilege escalation/denial of service issue exists in the AMD Radeon Kernel Mode driver Escape 0x2000c00 Call handler. An attacker with low privilege could potentially induce a Windows BugCheck or write to leak information.
Key phrases: privilege escalation denial of service issue, leak information
CVE-2020-12965: When combined with specific software sequences, AMD CPUs may transiently execute non-canonical loads and store using only the lower 48 address bits potentially resulting in data leakage.
Key phrases: data leakage
CVE-2020-12966: AMD EPYC™ Processors contain an information disclosure vulnerability in the Secure Encrypted Virtualization with Encrypted State (SEV-ES) and Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP). A local authenticated attacker could potentially exploit this vulnerability leading to leaking guest data by the malicious hypervisor.
Key phrases: information disclosure, leaking guest data
CVE-2020-12967: The lack of nested page table protection in the AMD SEV/SEV-ES feature could potentially lead to arbitrary code execution within the guest VM if a malicious administrator has access to compromise the server hypervisor.
Key phrases: nested page table protection, arbitrary code execution
CVE-2020-1297: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1298, CVE-2020-1318, CVE-2020-1320.
Key phrases: cross-site-scripting (xss), microsoft office sharepoint xss
CVE-2020-1298: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177, CVE-2020-1183, CVE-2020-1297, CVE-2020-1318, CVE-2020-1320.
Key phrases: cross-site-scripting (xss), microsoft office sharepoint xss
CVE-2020-12980: An out of bounds write and read vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
Key phrases: out of bounds write, read, escalation of privilege, denial of service, escalation privilege
CVE-2020-12981: An insufficient input validation in the AMD Graphics Driver for Windows 10 may allow unprivileged users to unload the driver, potentially causing memory corruptions in high privileged processes, which can lead to escalation of privileges or denial of service.
Key phrases: unload the driver, memory corruptions, escalation of privileges, denial of service, insufficient input validation, escalation privilege
CVE-2020-12982: An invalid object pointer free vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
Key phrases: invalid object pointer free, escalation of privilege, denial of service, escalation privilege
CVE-2020-12983: An out of bounds write vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privileges or denial of service.
Key phrases: out of bounds write, escalation of privileges, denial of service, escalation privilege
CVE-2020-12985: An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may lead to escalation of privilege or denial of service.
Key phrases: pointer validation, escalation of privilege, denial of service, escalation privilege
CVE-2020-12986: An insufficient pointer validation vulnerability in the AMD Graphics Driver for Windows 10 may cause arbitrary code execution in the kernel, leading to escalation of privilege or denial of service.
Key phrases: cause arbitrary code execution, pointer validation, escalation of privilege, denial of service, escalation privilege
CVE-2020-12987: A heap information leak/kernel pool address disclosure vulnerability in the AMD Graphics Driver for Windows 10 may lead to KASLR bypass.
Key phrases: KASLR bypass, heap information leak, kernel pool address disclosure, kaslr bypass
CVE-2020-12988: A potential denial of service (DoS) vulnerability exists in the integrated chipset that may allow a malicious attacker to hang the system when it is rebooted.
Key phrases: denial of service (DoS), hang the system when it is rebooted, denial of service (dos)
CVE-2020-1299: A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'.
Key phrases: gain the same user rights, remote code execution if a .LNK file is, lnk remote code execution
CVE-2020-1300: A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an attacker would have to convince a user to either open a specially crafted cabinet file or spoof a network printer and trick a user into installing a malicious cabinet file disguised as a printer driver.The update addresses the vulnerability by correcting how Windows handles cabinet files., aka 'Windows Remote Code Execution Vulnerability'.
Key phrases: remote code execution, windows remote code execution, convince, spoofing
CVE-2020-1301: A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests, aka 'Windows SMB Remote Code Execution Vulnerability'.
Key phrases: remote code execution
CVE-2020-1302: An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the vulnerability, an attacker would require unprivileged execution on the victim system, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1272, CVE-2020-1277, CVE-2020-1312.
Key phrases: elevation of privilege, windows installer elevation of privilege, elevation privilege
CVE-2020-1303: <p>An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in an elevated context.</p><p>An attacker could exploit this vulnerability by running a specially crafted application on the victim system.</p><p>The update addresses the vulnerability by correcting the way the Windows Runtime handles objects in memory.</p>
Key phrases: run arbitrary code, elevation of privilege, elevation privilege
CVE-2020-1304: An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1231, CVE-2020-1233, CVE-2020-1235, CVE-2020-1265, CVE-2020-1282, CVE-2020-1306, CVE-2020-1334.
Key phrases: elevation of privilege, windows runtime elevation of privilege, elevation privilege
CVE-2020-1305: An elevation of privilege vulnerability exists when the Windows State Repository Service improperly handles objects in memory, aka 'Windows State Repository Service Elevation of Privilege Vulnerability'.
Key phrases: elevation of privilege, windows state repository service elevation of privilege, elevation privilege
CVE-2020-1306: An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1231, CVE-2020-1233, CVE-2020-1235, CVE-2020-1265, CVE-2020-1282, CVE-2020-1304, CVE-2020-1334.
Key phrases: elevation of privilege, windows runtime elevation of privilege, elevation privilege
CVE-2020-1307: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0986, CVE-2020-1237, CVE-2020-1246, CVE-2020-1262, CVE-2020-1264, CVE-2020-1266, CVE-2020-1269, CVE-2020-1273, CVE-2020-1274, CVE-2020-1275, CVE-2020-1276, CVE-2020-1316.
Key phrases: elevation of privilege, windows kernel elevation of privilege, elevation privilege
CVE-2020-1308: <p>An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p><p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.</p><p>The update addresses the vulnerability by correcting how DirectX handles objects in memory.</p>
Key phrases: run arbitrary code, elevation of privilege, elevation privilege
CVE-2020-1309: An elevation of privilege vulnerability exists when the Microsoft Store Runtime improperly handles memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Microsoft Store Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1222.
Key phrases: gain execution, elevation of privilege, elevation privilege
CVE-2020-13091: pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
Key phrases: untrusted file, execute commands
CVE-2020-13092: scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the joblib.load() function is documented as unsafe and it is the user's responsibility to use the function in a secure manner
Key phrases: untrusted file, unsafe, execute commands
CVE-2020-13093: iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal.
Key phrases: directory traversal
CVE-2020-13094: Dolibarr before 11.0.4 allows XSS.
Key phrases: XSS, xss
CVE-2020-13095: Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the path to a directory containing code executed by root.
CVE-2020-1310: An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1207, CVE-2020-1247, CVE-2020-1251, CVE-2020-1253.
Key phrases: elevation of privilege, elevation privilege
CVE-2020-13100: Aristas CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (crash and restart) in the ControllerOob agent via a malformed control-plane packet.
Key phrases: denial of service (crash and restart), cause a denial of service (crash and, malformed control-plane packet
CVE-2020-13101: In OASIS Digital Signature Services (DSS) 1.0, an attacker can control the validation outcome (i.e., trigger either a valid or invalid outcome for a valid or invalid signature) via a crafted XML signature, when the InlineXML option is used. This defeats the expectation of non-repudiation.
CVE-2020-13109: Morita Shogi 64 through 2020-05-02 for Nintendo 64 devices allows remote attackers to execute arbitrary code via crafted packet data to the built-in modem because 0x800b3e94 (aka the IF subcommand to top-level command 7) has a stack-based buffer overflow.
Key phrases: execute arbitrary code, execute arbitrary code via crafted packet data to, stack-based buffer overflow, stack based buffer overflow
CVE-2020-1311: An elevation of privilege vulnerability exists when Component Object Model (COM) client uses special case IIDs, aka 'Component Object Model Elevation of Privilege Vulnerability'.
Key phrases: elevation of privilege, elevation privilege
CVE-2020-13110: The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.
Key phrases: allows arbitrary code execution, arbitrary code execution and privilege escalation via injection
CVE-2020-13111: NaviServer 4.99.4 to 4.99.19 allows denial of service due to the nsd/driver.c ChunkedDecode function not properly validating the length of a chunk. A remote attacker can craft a chunked-transfer request that will result in a negative value being passed to memmove via the size parameter, causing the process to crash.
Key phrases: the nsd/driver.c ChunkedDecode function not properly, denial of service, process to crash
CVE-2020-13112: An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashes. This is different from CVE-2020-0093.
Key phrases: buffer over-reads, information disclosure, crashes, buffer over read
CVE-2020-13113: An issue was discovered in libexif before 0.6.22. Use of uninitialized memory in EXIF Makernote handling could lead to crashes and potential use-after-free conditions.
Key phrases: uninitialized memory, crashes, use-after-free conditions, use after free
CVE-2020-13114: An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.
Key phrases: unrestricted size, large amounts of compute time
CVE-2020-13116: OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation.
Key phrases: XSS by an authenticated user via policy creation, xss