yahoo-inc/cve-impacts huggingface dataset:
CVE-2020-8660: CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.
Key phrases: 1.13.0 TLS inspector bypass, tls inspector bypass, bypass security
CVE-2020-8661: CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
CVE-2020-8663: Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.
Key phrases: file descriptors
CVE-2020-8664: CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
Key phrases: active config dump
CVE-2020-8669: Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable information disclosure via network access.
Key phrases: potentially enable information disclosure via network access, improper input validation
CVE-2020-8670: Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, race condition, escalation privilege
CVE-2020-8671: Insufficient control flow management in BIOS firmware 8th, 9th Generation Intel(R) Core(TM) Processors and Intel(R) Celeron(R) Processor 4000 Series may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, insufficient control flow management
CVE-2020-8672: Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors may allow an unauthenticated user to potentially enable elevation of privilege or denial of service via local access.
Key phrases: potentially enable elevation of privilege or denial of, out of bound read, denial of service, local access, elevation privilege
CVE-2020-8674: Out-of-bounds read in DHCPv6 subsystem in Intel(R) AMT and Intel(R)ISM versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64 and 14.0.33 may allow an unauthenticated user to potentially enable information disclosure via network access.
Key phrases: potentially enable information disclosure via network access, out-of-bounds read, out of bounds read
CVE-2020-8675: Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Key phrases: potentially enable escalation of privilege via physical access, insufficient control flow management, escalation privilege
CVE-2020-8676: Improper access control in the Intel(R) Visual Compute Accelerator 2, all versions, may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2020-8677: Improper access control in the Intel(R) Visual Compute Accelerator 2, all versions, may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2020-8678: Improper access control for Intel(R) Graphics Drivers before version 15.45.33.5164 and 27.20.100.8280 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Key phrases: potentially enable an escalation of privilege via local, improper access control, local access, escalation privilege
CVE-2020-8679: Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, out-of-bounds write, out of bounds write
CVE-2020-8680: Race condition in some Intel(R) Graphics Drivers before version 15.40.45.5126 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, race condition, escalation privilege
CVE-2020-8681: Out of bounds write in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, out of bounds write, escalation privilege
CVE-2020-8682: Out of bounds read in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, out of bounds read in system driver
CVE-2020-8683: Improper buffer restrictions in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper buffer restrictions
CVE-2020-8684: Improper access control in firmware for Intel(R) PAC with Arria(R) 10 GX FPGA before Intel Acceleration Stack version 1.2.1 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2020-8685: Improper authentication in subsystem for Intel (R) LED Manager for NUC before version 1.2.3 may allow privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper authentication
CVE-2020-8687: Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path, escalation privilege
CVE-2020-8688: Improper input validation in the Intel(R) RAID Web Console 3 for Windows* may allow an unauthenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, improper input validation
CVE-2020-8689: Improper buffer restrictions in the Intel(R) Wireless for Open Source before version 1.5 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, improper buffer restrictions
CVE-2020-8690: Protection mechanism failure in Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Key phrases: potentially enable escalation of privilege and/or denial of, protection mechanism failure, denial of service, local access, escalation privilege
CVE-2020-8691: A logic issue in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Key phrases: potentially enable escalation of privilege and/or denial of, logic issue, denial of service, local access, escalation privilege
CVE-2020-8692: Insufficient access control in the firmware of the Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Key phrases: potentially enable escalation of privilege and/or denial of, insufficient access control, denial of service, local access, escalation privilege
CVE-2020-8693: Improper buffer restrictions in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Key phrases: potentially enable escalation of privilege and/or denial of, improper buffer restrictions, denial of service, local access, escalation privilege
CVE-2020-8694: Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, insufficient access control
CVE-2020-8695: Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, observable discrepancy
CVE-2020-8696: Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, sensitive information
CVE-2020-8698: Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper isolation of shared resources
CVE-2020-8700: Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2020-8701: Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2020-8702: Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path element, escalation privilege
CVE-2020-8703: Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper buffer restrictions, escalation privilege
CVE-2020-8704: Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, race condition, escalation privilege
CVE-2020-8705: Insecure default initialization of resource in Intel(R) Boot Guard in Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 3.1.80 and 4.0.30, Intel(R) SPS versions before E5_04.01.04.400, E3_04.01.04.200, SoC-X_04.00.04.200 and SoC-A_04.00.04.300 may allow an unauthenticated user to potentially enable escalation of privileges via physical access.
Key phrases: potentially enable escalation of privileges via physical access, insecure default initialization of resource, escalation privilege
CVE-2020-8706: Buffer overflow in a daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, buffer overflow, escalation privilege
CVE-2020-8707: Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, buffer overflow, escalation privilege
CVE-2020-8708: Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, improper authentication, escalation privilege
CVE-2020-8709: Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, improper authentication, escalation privilege
CVE-2020-8710: Buffer overflow in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, buffer overflow, escalation privilege
CVE-2020-8711: Improper access control in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2020-8712: Buffer overflow in a verification process for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, buffer overflow, escalation privilege
CVE-2020-8713: Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, improper authentication, escalation privilege
CVE-2020-8714: Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper authentication, escalation privilege
CVE-2020-8715: Invalid pointer for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, invalid pointer
CVE-2020-8716: Improper access control for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2020-8717: Improper input validation in a subsystem for some Intel Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper input validation
CVE-2020-8718: Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, buffer overflow, escalation privilege
CVE-2020-8719: Buffer overflow in subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, buffer overflow, escalation privilege
CVE-2020-8720: Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, buffer overflow
CVE-2020-8721: Improper input validation for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2020-8722: Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, buffer overflow, escalation privilege
CVE-2020-8723: Cross-site scripting for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, cross-site scripting, escalation privilege
CVE-2020-8729: Buffer copy without checking size of input for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, buffer copy, escalation privilege
CVE-2020-8730: Heap-based overflow for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, heap-based overflow, heap based overflow, escalation privilege
CVE-2020-8731: Incorrect execution-assigned permissions in the file system for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect execution-assigned permissions, escalation privilege
CVE-2020-8732: Heap-based buffer overflow in the firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, heap-based buffer overflow, heap based buffer overflow, escalation privilege
CVE-2020-8733: Improper buffer restrictions in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper buffer restrictions, escalation privilege
CVE-2020-8734: Improper input validation in the firmware for Intel(R) Server Board M10JNP2SB before version 7.210 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2020-8736: Improper access control in subsystem for the Intel(R) Computing Improvement Program before version 2.4.5718 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2020-8737: Improper buffer restrictions in the Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software before version 20.1 may allow an unauthenticated user to potentially enable escalation of privilege and/or information disclosure via physical access.
Key phrases: potentially enable escalation of privilege and/or information disclosure, improper buffer restrictions, physical access, escalation privilege
CVE-2020-8738: Improper conditions check in Intel BIOS platform sample code for some Intel(R) Processors before may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper conditions check, escalation privilege
CVE-2020-8739: Use of potentially dangerous function in Intel BIOS platform sample code for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, potentially dangerous function, escalation privilege
CVE-2020-8740: Out of bounds write in Intel BIOS platform sample code for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, out of bounds write, escalation privilege
CVE-2020-8741: Improper permissions in the installer for the Intel(R) Thunderbolt(TM) non-DCH driver, all versions, for Windows may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper permissions, escalation privilege
CVE-2020-8742: Improper input validation in the firmware for Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2020-8743: Improper permissions in the installer for the Intel(R) Mailbox Interface driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper permissions, escalation privilege
CVE-2020-8744: Improper initialization in subsystem for Intel(R) CSME versions before12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 4.0.30 Intel(R) SPS versions before E3_05.01.04.200 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper initialization, escalation privilege
CVE-2020-8745: Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25 , Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Key phrases: potentially enable escalation of privilege via physical access, insufficient control flow management, escalation privilege
CVE-2020-8746: Integer overflow in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, integer overflow
CVE-2020-8747: Out-of-bounds read in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.
Key phrases: potentially enable information disclosure and/or denial of service, out-of-bounds read in subsystem, out of bounds read
CVE-2020-8749: Out-of-bounds read in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Key phrases: potentially enable escalation of privilege via adjacent access, out-of-bounds read in subsystem, out of bounds read, escalation privilege
CVE-2020-8750: Use after free in Kernel Mode Driver for Intel(R) TXE versions before 3.1.80 and 4.0.30 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, use after free, escalation privilege
CVE-2020-8751: Insufficient control flow management in subsystem for Intel(R) CSME versions before 11.8.80, Intel(R) TXE versions before 3.1.80 may allow an unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, insufficient control flow management
CVE-2020-8752: Out-of-bounds write in IPv6 subsystem for Intel(R) AMT, Intel(R) ISM versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 14.0.45 may allow an unauthenticated user to potentially enable escalation of privileges via network access.
Key phrases: potentially enable escalation of privileges via network access, out-of-bounds write, out of bounds write, escalation privilege
CVE-2020-8753: Out-of-bounds read in DHCP subsystem for Intel(R) AMT, Intel(R) ISM versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access.
Key phrases: potentially enable information disclosure via network access, out-of-bounds read, out of bounds read
CVE-2020-8754: Out-of-bounds read in subsystem for Intel(R) AMT, Intel(R) ISM versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access.
Key phrases: potentially enable information disclosure via network access, out-of-bounds read in subsystem, out of bounds read
CVE-2020-8755: Race condition in subsystem for Intel(R) CSME versions before 12.0.70 and 14.0.45, Intel(R) SPS versions before E5_04.01.04.400 and E3_05.01.04.200 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Key phrases: potentially enable escalation of privilege via physical access, race condition, escalation privilege
CVE-2020-8756: Improper input validation in subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2020-8757: Out-of-bounds read in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70 and 14.0.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, out-of-bounds read in subsystem, out of bounds read, escalation privilege
CVE-2020-8758: Improper buffer restrictions in network subsystem in provisioned Intel(R) AMT and Intel(R) ISM versions before 11.8.79, 11.12.79, 11.22.79, 12.0.68 and 14.0.39 may allow an unauthenticated user to potentially enable escalation of privilege via network access. On un-provisioned systems, an authenticated user may potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via network access, improper buffer restrictions, local access, escalation privilege
CVE-2020-8759: Improper access control in the installer for Intel(R) SSD DCT versions before 3.0.23 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2020-8760: Integer overflow in subsystem for Intel(R) AMT versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 14.0.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, integer overflow, escalation privilege
CVE-2020-8761: Inadequate encryption strength in subsystem for Intel(R) CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, inadequate encryption strength
CVE-2020-8763: Improper permissions in the installer for the Intel(R) RealSense(TM) D400 Series UWP driver for Windows* 10 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper permissions, escalation privilege
CVE-2020-8764: Improper access control in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2020-8765: Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2020-8766: Improper conditions check in the Intel(R) SGX DCAP software before version 1.6 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, improper conditions check
CVE-2020-8767: Uncaught exception in the Intel(R) 50GbE IP Core for Intel(R) Quartus Prime before version 20.2 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access
CVE-2020-8768: An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. There is an insecure mechanism for read and write access to the configuration of the device. The mechanism can be discovered by examining a link on the website of the device.
Key phrases: insecure mechanism
CVE-2020-8771: The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client to be logged in as the first account on the list of administrator accounts.
Key phrases: authentication bypass
CVE-2020-8772: The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker who knows the username of an administrator can log in.
Key phrases: authorization check
CVE-2020-8773: The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability.
Key phrases: stored cross-site scripting (xss)
CVE-2020-8774: Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function.
Key phrases: reflected cross-site scripting
CVE-2020-8775: Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
Key phrases: stored cross-site scripting (xss)
CVE-2020-8776: Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.
Key phrases: xss
CVE-2020-8777: Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.
Key phrases: xss
CVE-2020-8778: Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.
Key phrases: xss, write access
CVE-2020-8781: Lack of input sanitization in UpdateRebootMgr service of ALEOS 4.11 and later allow an escalation to root from a low-privilege process.
Key phrases: root from a low-privilege process, lack of input sanitization
CVE-2020-8782: Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution.
Key phrases: remote code execution, unauthenticated rpc server
CVE-2020-8783: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
Key phrases: SQL Injection (issue 1 of 4), sql injection
CVE-2020-8784: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
Key phrases: SQL Injection (issue 2 of 4), sql injection
CVE-2020-8785: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
Key phrases: SQL Injection (issue 3 of 4), sql injection
CVE-2020-8786: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
Key phrases: SQL Injection (issue 4 of 4), sql injection
CVE-2020-8787: SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
Key phrases: be submitted, bean id
CVE-2020-8788: Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report.
Key phrases: XSS (and HTML injection) via the, xss, html injection
CVE-2020-8789: Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration.
Key phrases: Persistent XSS via a Usergroup name under the, persistent xss
CVE-2020-8790: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has weak password requirements combined with improper restriction of excessive authentication attempts, which could allow a remote attacker to discover user credentials and obtain access via a brute force attack.
Key phrases: obtain access, discover user credentials and obtain access via a, weak password requirements, brute force
CVE-2020-8791: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.
Key phrases: submit API requests using authenticated but unauthorized tokens, idor issues
CVE-2020-8792: The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) has an information-exposure issue. In the mobile app, an attempt to add an already-bound lock by its barcode reveals the email address of the account to which the lock is bound, as well as the name of the lock. Valid barcode inputs can be easily guessed because barcode strings follow a predictable pattern. Correctly guessed valid barcode inputs entered through the app interface disclose arbitrary users' email addresses and lock names.
Key phrases: disclose arbitrary users, information-exposure issue, information exposure
CVE-2020-8793: OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.
Key phrases: read arbitrary files, read arbitrary files (e.g., untrusted search path, race conditions
CVE-2020-8794: OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
Key phrases: attack a server because the server code launches, remote code execution, out-of-bounds read, client side, out of bounds read
CVE-2020-8795: In GitLab Enterprise Edition (EE) 12.5.0 through 12.7.5, sharing a group with a group could grant project access to unauthorized users.
Key phrases: project access
CVE-2020-8796: Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.
Key phrases: Remote Code Execution on the server, remote code execution
CVE-2020-8797: Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call (aka Command Line Injection), if the undocumented telnetd service is enabled and the attacker can authenticate as admin from the local network.
Key phrases: gain root access, gain root access to the Linux subsystem via, unsanitized exec call, command line injection
CVE-2020-8798: httpd in Juplink RX4-1500 v1.0.3-v1.0.5 allows remote attackers to change or access router settings by connecting to the unauthenticated setup3.htm endpoint from the local network.
Key phrases: change or access router settings by connecting to, unauthenticated endpoint
CVE-2020-8799: A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website.
Key phrases: stored xss
CVE-2020-8800: SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.
Key phrases: EmailsControllerActionGetFromFields PHP Object Injection, object injection
CVE-2020-8801: SuiteCRM through 7.11.11 allows PHAR Deserialization.
Key phrases: PHAR Deserialization, phar deserialization
CVE-2020-8802: SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
Key phrases: incorrect access control, action_savehtmlfield bean manipulation
CVE-2020-8803: SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.
Key phrases: include arbitrary .php files within the webroot via, directory traversal, arbitrary php
CVE-2020-8804: SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
Key phrases: SQL Injection via the SOAP API, sql injection
CVE-2020-8806: Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid chain could be incorrectly rejected because timestamp requirements on block headers were not properly enforced.
Key phrases: trigger consensus failure and double spending
CVE-2020-8807: In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel.
Key phrases: obtain sensitive information, timing side channel
CVE-2020-8808: The CorsairLLAccess64.sys and CorsairLLAccess32.sys drivers in CORSAIR iCUE before 3.25.60 allow local non-privileged users (including low-integrity level processes) to read and write to arbitrary physical memory locations, and consequently gain NT AUTHORITY\\SYSTEM privileges, via a function call such as MmMapIoSpace.
Key phrases: gain NT AUTHORITY\\SYSTEM privileges, read and write to arbitrary physical memory locations, integrity
CVE-2020-8809: Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.
Key phrases: code execution, man in the middle
CVE-2020-8810: An issue was discovered in Gurux GXDLMS Director through 8.5.1905.1301. When downloading OBIS codes, it does not verify that the downloaded files are actual OBIS codes and doesn't check for path traversal. This allows the attacker exploiting CVE-2020-8809 to send executable files and place them in an autorun directory, or to place DLLs inside the existing GXDLMS Director installation (run on next execution of GXDLMS Director). This can be used to achieve code execution even if the user doesn't have any add-ins installed.
Key phrases: send executable files and place them in an, path traversal, code execution
CVE-2020-8811: ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures.
Key phrases: change other users' profile pictures
CVE-2020-8812: Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug.
Key phrases: insert malicious JavaScript on the WYSIWYG editor
CVE-2020-8813: graph_realtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands via shell metacharacters in, arbitrary os command
CVE-2020-8815: Improper connection handling in the base connection handler in IKTeam BearFTP before v0.3.1 allows a remote attacker to achieve denial of service via a Slowloris approach by sending a large volume of small packets.
Key phrases: achieve denial of service via a Slowloris approach, improper connection handling, slowloris approach
CVE-2020-8816: Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.
Key phrases: Remote Code Execution by privileged dashboard users via, remote code execution, dhcp static lease
CVE-2020-8817: Dataiku DSS before 6.0.5 allows attackers write access to the project to modify the "Created by" metadata.
Key phrases: the project to modify the "Created by, write access
CVE-2020-8818: An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Key phrases: bypass the payment process (e.g., remotely replace critical plugin settings (merchant ID, origin authentication, subsequent payments, spoofing
CVE-2020-8819: An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Key phrases: bypass the payment process (e.g., remotely replace critical plugin settings (merchant ID, lack of origin authentication, subsequent payments, spoofing
CVE-2020-8820: An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed.
Key phrases: xss
CVE-2020-8821: An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users.
Key phrases: improper data validation, changes
CVE-2020-8822: Digi TransPort WR21 5.2.2.3, WR44 5.1.6.4, and WR44v2 5.1.6.9 devices allow stored XSS in the web application.
Key phrases: stored XSS in the web application, stored xss
CVE-2020-8823: htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
Key phrases: reflected xss
CVE-2020-8824: Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.
Key phrases: XSS via a Managed Device name on the, xss
CVE-2020-8825: index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.
Key phrases: stored XSS, xss
CVE-2020-8826: As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication.
CVE-2020-8827: As of v1.5.0, the Argo API does not implement anti-automation measures such as rate limiting, account lockouts, or other anti-bruteforce measures. Attackers can submit an unlimited number of authentication attempts without consequence.
Key phrases: consequence
CVE-2020-8828: As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be kept secret and could wind up just about anywhere.
Key phrases: privilege escalation
CVE-2020-8829: CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis.
Key phrases: access the panel and perform scraping or other, csrf
CVE-2020-8830: CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen.
Key phrases: access the panel, csrf, ssrf
CVE-2020-8831: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
Key phrases: create a symlink at /var/lock/, escalate privileges
CVE-2020-8832: The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-2019-14615 ("The Linux kernel did not properly clear data structures on context switches for certain Intel graphics processors.") was discovered to be incomplete, meaning that in versions of the kernel before 4.15.0-91.92, an attacker could use this vulnerability to expose sensitive information.
Key phrases: sensitive information