Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1796.

There is an improper authorization vulnerability in several smartphones. The software incorrectly performs an authorization to certain user, successful exploit could allow a low privilege user to do certain operation which the user are supposed not to do.Affected product versions include:HUAWEI Mate 20 versions Versions earlier than 10.0.0.188(C00E74R3P8);HUAWEI Mate 30 Pro versions Versions earlier than 10.0.0.203(C00E202R7P2).


Provide references for further information: Can you share references or external links related to CVE-2020-1796?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1796?


Explain the CVE ID: What does the identifier CVE-2020-1797 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1797.

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system does not properly restrict certain operation in ADB mode, successful exploit could allow certain user break the limit of digital balance function.


Provide references for further information: Can you share references or external links related to CVE-2020-1797?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1797?


Explain the CVE ID: What does the identifier CVE-2020-1798 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1798.

HUAWEI P30 smartphones with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. A logic error occurs when handling NFC work, an attacker should establish a NFC connection to the target phone, and then do a series of operations on the target phone. Successful exploit could allow a guest user do certain operation which is beyond the guest user's privilege.


Provide references for further information: Can you share references or external links related to CVE-2020-1798?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1798?


Explain the CVE ID: What does the identifier CVE-2020-1799 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1799.

E6878-370 with versions of 10.0.3.1(H557SP27C233), 10.0.3.1(H563SP1C00), 10.0.3.1(H563SP1C233) has a use after free vulnerability. The software references memory after it has been freed in certain scenario, the attacker does a series of crafted operations through web portal, successful exploit could cause a use after free condition which may lead to malicious code execution.


Provide references for further information: Can you share references or external links related to CVE-2020-1799?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1799?


Explain the CVE ID: What does the identifier CVE-2020-1800 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1800.

HUAWEI smartphones P30 with versions earlier than 10.0.0.185(C00E85R1P11) have an improper access control vulnerability. The software incorrectly restricts access to a function interface from an unauthorized actor, the attacker tricks the user into installing a crafted application, successful exploit could allow the attacker do certain unauthenticated operations.


Provide references for further information: Can you share references or external links related to CVE-2020-1800?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1800?


Explain the CVE ID: What does the identifier CVE-2020-1801 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1801.

There is an improper authentication vulnerability in several smartphones. Certain function interface in the system does not sufficiently validate the caller's identity in certain share scenario, successful exploit could cause information disclosure. Affected product versions include:Mate 30 Pro versions Versions earlier than 10.0.0.205(C00E202R7P2);Mate 30 versions Versions earlier than 10.0.0.205(C00E201R7P2).


Provide references for further information: Can you share references or external links related to CVE-2020-1801?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1801?


Explain the CVE ID: What does the identifier CVE-2020-1802 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1802.

There is an insufficient integrity validation vulnerability in several products. The device does not sufficiently validate the integrity of certain file in certain loading processes, successful exploit could allow the attacker to load a crafted file to the device through USB.Affected product versions include:OSCA-550 versions 1.0.1.23(SP2);OSCA-550A versions 1.0.1.23(SP2);OSCA-550AX versions 1.0.1.23(SP2);OSCA-550X versions 1.0.1.23(SP2).


Provide references for further information: Can you share references or external links related to CVE-2020-1802?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1802?


Explain the CVE ID: What does the identifier CVE-2020-1803 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1803.

Huawei smartphones Honor V20 with versions earlier than 10.0.0.179(C636E3R4P3),versions earlier than 10.0.0.180(C185E3R3P3),versions earlier than 10.0.0.180(C432E10R3P4) have an information disclosure vulnerability. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, successful exploit could cause information disclosure.


Provide references for further information: Can you share references or external links related to CVE-2020-1803?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-smartphone-en'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-smartphone-en'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1803?


Explain the CVE ID: What does the identifier CVE-2020-1804 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1804.

Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 1 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1805 and CVE-2020-1806.


Provide references for further information: Can you share references or external links related to CVE-2020-1804?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1804?


Explain the CVE ID: What does the identifier CVE-2020-1805 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1805.

Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 2 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1804 and CVE-2020-1806.


Provide references for further information: Can you share references or external links related to CVE-2020-1805?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1805?


Explain the CVE ID: What does the identifier CVE-2020-1806 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1806.

Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00E156R2P4) has three out of bounds vulnerabilities. Certain driver program does not sufficiently validate certain parameters received, that would lead to several bytes out of bound read. Successful exploit may cause information disclosure or service abnormal. This is 3 out of 3 out of bounds vulnerabilities found. Different than CVE-2020-1804 and CVE-2020-1805.


Provide references for further information: Can you share references or external links related to CVE-2020-1806?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1806?


Explain the CVE ID: What does the identifier CVE-2020-1807 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1807.

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E74R3P8) have an improper authorization vulnerability. The software does not properly restrict certain user's modification of certain configuration file, successful exploit could allow the attacker to bypass app lock after a series of operation in ADB mode.


Provide references for further information: Can you share references or external links related to CVE-2020-1807?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1807?


Explain the CVE ID: What does the identifier CVE-2020-1808 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1808.

Honor 20;HONOR 20 PRO;Honor Magic2;HUAWEI Mate 20 X;HUAWEI P30;HUAWEI P30 Pro;Honor View 20 smartphones with versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.187(C00E60R4P11); versions earlier than 10.0.0.176(C00E60R2P11);9.1.0.135(C00E133R2P1); versions earlier than 10.1.0.123(C431E22R3P5), versions earlier than 10.1.0.126(C636E5R3P4), versions earlier than 10.1.0.160(C00E160R2P11); versions earlier than 10.1.0.126(C185E8R5P1), versions earlier than 10.1.0.126(C636E9R2P4), versions earlier than 10.1.0.160(C00E160R2P8); versions earlier than 10.0.0.179(C636E3R4P3), versions earlier than 10.0.0.180(C185E3R3P3), versions earlier than 10.0.0.180(C432E10R3P4), versions earlier than 10.0.0.181(C675E5R1P2) have an out of bound read vulnerability. The software reads data past the end of the intended buffer. The attacker tricks the user into installing a crafted application, successful exploit may cause information disclosure or service abnormal.


Provide references for further information: Can you share references or external links related to CVE-2020-1808?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1808?


Explain the CVE ID: What does the identifier CVE-2020-1809 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1809.

HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143(C00E143R2P4) have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation, successful exploit could allow the attacker read certain files without unlock the phone leading to information disclosure.


Provide references for further information: Can you share references or external links related to CVE-2020-1809?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1809?


Explain the CVE ID: What does the identifier CVE-2020-1810 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1810.

There is a weak algorithm vulnerability in some Huawei products. The affected products use the RSA algorithm in the SSL key exchange algorithm which have been considered as a weak algorithm. Attackers may exploit this vulnerability to leak some information.


Provide references for further information: Can you share references or external links related to CVE-2020-1810?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1810?


Explain the CVE ID: What does the identifier CVE-2020-1811 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1811.

GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exploit this vulnerability by sending crafted commands to the affected device. Successful exploit could allow an attacker to execute commands.


Provide references for further information: Can you share references or external links related to CVE-2020-1811?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1811?


Explain the CVE ID: What does the identifier CVE-2020-1812 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1812.

HUAWEI P30 smartphones with versions earlier than 10.0.0.173(C00E73R1P11) have an improper authentication vulnerability. Due to improperly validation of certain application, an attacker should trick the user into installing a malicious application to exploit this vulnerability. Successful exploit could allow the attacker to bypass the authentication to perform unauthorized operations.


Provide references for further information: Can you share references or external links related to CVE-2020-1812?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1812?


Explain the CVE ID: What does the identifier CVE-2020-1813 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1813.

HUAWEI P30 smart phone with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. Due to improper authentication of specific interface, in specific scenario attackers could access specific interface without authentication. Successful exploit could allow the attacker to perform unauthorized operations.


Provide references for further information: Can you share references or external links related to CVE-2020-1813?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1813?


Explain the CVE ID: What does the identifier CVE-2020-1814 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1814.

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Dangling pointer dereference vulnerability. An authenticated attacker may do some special operations in the affected products in some special scenarios to exploit the vulnerability. Due to improper race conditions of different operations, successful exploit will lead to Dangling pointer dereference, causing some service abnormal.


Provide references for further information: Can you share references or external links related to CVE-2020-1814?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1814?


Explain the CVE ID: What does the identifier CVE-2020-1815 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1815.

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a memory leak vulnerability. The software does not sufficiently track and release allocated memory while parse certain message, the attacker sends the message continuously that could consume remaining memory. Successful exploit could cause memory exhaust.


Provide references for further information: Can you share references or external links related to CVE-2020-1815?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1815?


Explain the CVE ID: What does the identifier CVE-2020-1816 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1816.

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Denial of Service (DoS) vulnerability. Due to improper processing of specific IPSEC packets, remote attackers can send constructed IPSEC packets to affected devices to exploit this vulnerability. Successful exploit could cause the IPSec function of the affected device abnormal.


Provide references for further information: Can you share references or external links related to CVE-2020-1816?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1816?


Explain the CVE ID: What does the identifier CVE-2020-1817 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1817.

Huawei PCManager with versions earlier than 10.0.1.36 has a privilege escalation vulnerability. Due to improper permission management of specific files, local attackers with low permissions can inject commands to exploit this vulnerability. Successful exploit may cause privilege escalation.


Provide references for further information: Can you share references or external links related to CVE-2020-1817?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1817?


Explain the CVE ID: What does the identifier CVE-2020-1825 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1825.

FusionAccess with versions earlier than 6.5.1.SPC002 have a Denial of Service (DoS) vulnerability. Due to insufficient verification on specific input, attackers can exploit this vulnerability by sending constructed messages to the affected device through another device on the same network. Successful exploit could cause affected devices to be abnormal.


Provide references for further information: Can you share references or external links related to CVE-2020-1825?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1825?


Explain the CVE ID: What does the identifier CVE-2020-1826 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1826.

Huawei Honor Magic2 mobile phones with versions earlier than 10.0.0.175(C00E59R2P11) have an information leak vulnerability. Due to a module using weak encryption tool, an attacker with the root permission may exploit the vulnerability to obtain some information.


Provide references for further information: Can you share references or external links related to CVE-2020-1826?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1826?


Explain the CVE ID: What does the identifier CVE-2020-1827 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1827.

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have an information leakage vulnerability. An attacker can exploit this vulnerability by sending specific request packets to affected devices. Successful exploit may lead to information leakage.


Provide references for further information: Can you share references or external links related to CVE-2020-1827?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1827?


Explain the CVE ID: What does the identifier CVE-2020-1828 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1828.

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have an input validation vulnerability where the IPSec module does not validate a field in a specific message. Attackers can send specific message to cause out-of-bound read, compromising normal service.


Provide references for further information: Can you share references or external links related to CVE-2020-1828?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1828?


Explain the CVE ID: What does the identifier CVE-2020-1829 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1829.

Huawei NIP6800 versions V500R001C30 and V500R001C60SPC500; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, and V500R001C60SPC500 have a vulnerability that the IPSec module handles a message improperly. Attackers can send specific message to cause double free memory. This may compromise normal service.


Provide references for further information: Can you share references or external links related to CVE-2020-1829?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1829?


Explain the CVE ID: What does the identifier CVE-2020-1830 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1830.

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a vulnerability that a memory management error exists when IPSec Module handing a specific message. This causes 1 byte out-of-bound read, compromising normal service.


Provide references for further information: Can you share references or external links related to CVE-2020-1830?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1830?


Explain the CVE ID: What does the identifier CVE-2020-1831 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1831.

HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.195(SP31C00E74R3P8) have an improper authorization vulnerability. The digital balance function does not sufficiently restrict the using time of certain user, successful exploit could allow the user break the limit of digital balance function after a series of operations with a PC.


Provide references for further information: Can you share references or external links related to CVE-2020-1831?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1831?


Explain the CVE ID: What does the identifier CVE-2020-1832 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1832.

E6878-370 products with versions of 10.0.3.1(H557SP27C233) and 10.0.3.1(H563SP1C00) have a stack buffer overflow vulnerability. The program copies an input buffer to an output buffer without verification. An attacker in the adjacent network could send a crafted message, successful exploit could lead to stack buffer overflow which may cause malicious code execution.


Provide references for further information: Can you share references or external links related to CVE-2020-1832?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1832?


Explain the CVE ID: What does the identifier CVE-2020-1833 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1833.

Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A logic error occurs when handling clock function, an attacker should do a series of crafted operations quickly before the phone is unlocked, successful exploit could allow the attacker to access clock information without unlock the phone.


Provide references for further information: Can you share references or external links related to CVE-2020-1833?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1833?


Explain the CVE ID: What does the identifier CVE-2020-1834 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1834.

HUAWEI P30 and HUAWEI P30 Pro with versions earlier than 10.1.0.135(C00E135R2P11) and versions earlier than 10.1.0.135(C00E135R2P8) have an insufficient integrity check vulnerability. The system does not check certain software package's integrity sufficiently. Successful exploit could allow an attacker to load a crafted software package to the device.


Provide references for further information: Can you share references or external links related to CVE-2020-1834?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1834?


Explain the CVE ID: What does the identifier CVE-2020-1835 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1835.

HUAWEI Mate 30 with versions earlier than 10.1.0.126(C00E125R5P3) have an information disclosure vulnerability. A logic judgment error occurs when the system handling Bluetooth connections, an attacker could craft as an authenticated Bluetooth peer to launch the attack. Successful exploit could cause information disclosure.


Provide references for further information: Can you share references or external links related to CVE-2020-1835?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1835?


Explain the CVE ID: What does the identifier CVE-2020-1836 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1836.

HUAWEI P30 with versions earlier than 10.1.0.160(C00E160R2P11) and HUAWEI P30 Pro with versions earlier than 10.1.0.160(C00E160R2P8) have an information disclosure vulnerability. Certain function's default configuration in the system seems insecure, an attacker should craft a WI-FI hotspot to launch the attack. Successful exploit could cause information disclosure.


Provide references for further information: Can you share references or external links related to CVE-2020-1836?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1836?


Explain the CVE ID: What does the identifier CVE-2020-1837 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1837.

ChangXiang 8 Plus with versions earlier than 9.1.0.136(C00E121R1P6T8) have a denial of service vulnerability. The device does not properly handle certain message from base station, the attacker could craft a fake base station to launch the attack. Successful exploit could cause a denial of signal service condition.


Provide references for further information: Can you share references or external links related to CVE-2020-1837?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1837?


Explain the CVE ID: What does the identifier CVE-2020-1838 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1838.

HUAWEI Mate 30 Pro with versions earlier than 10.1.0.150(C00E136R5P3) have is an improper authentication vulnerability. The device does not sufficiently validate certain credential of user's face, an attacker could craft the credential of the user, successful exploit could allow the attacker to pass the authentication with the crafted credential.


Provide references for further information: Can you share references or external links related to CVE-2020-1838?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1838?


Explain the CVE ID: What does the identifier CVE-2020-1839 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1839.

HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a race condition vulnerability. There is a timing window exists in which certain pointer members can be modified by another process that is operating concurrently, an attacker should trick the user into running a crafted application with high privilege, successful exploit could cause code execution.


Provide references for further information: Can you share references or external links related to CVE-2020-1839?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1839?


Explain the CVE ID: What does the identifier CVE-2020-1840 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1840.

HUAWEI Mate 20 smart phones with versions earlier than 10.0.0.175(C00E70R3P8) have an insufficient authentication vulnerability. A local attacker with high privilege can execute a specific command to exploit this vulnerability. Successful exploitation may cause information leak and compromise the availability of the smart phones.Affected product versions include: HUAWEI Mate 20 versions Versions earlier than 10.0.0.175(C00E70R3P8)


Provide references for further information: Can you share references or external links related to CVE-2020-1840?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1840?


Explain the CVE ID: What does the identifier CVE-2020-1841 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1841.

Huawei CloudLink Board version 20.0.0; DP300 version V500R002C00; RSE6500 versions V100R001C00, V500R002C00, and V500R002C00SPC900; and TE60 versions V500R002C00, V600R006C00, V600R006C00SPC200, V600R006C00SPC300, V600R006C10, V600R019C00, and V600R019C00SPC100 have an information leak vulnerability. An unauthenticated, remote attacker can make a large number of attempts to guess information. Successful exploitation may cause information leak.


Provide references for further information: Can you share references or external links related to CVE-2020-1841?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1841?


Explain the CVE ID: What does the identifier CVE-2020-1842 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1842.

Huawei HEGE-560 version 1.0.1.20(SP2); OSCA-550 and OSCA-550A version 1.0.0.71(SP1); and OSCA-550AX and OSCA-550X version 1.0.0.71(SP2) have an insufficient authentication vulnerability. An attacker can access the device physically and perform specific operations to exploit this vulnerability. Successful exploitation may cause the attacker obtain high privilege.


Provide references for further information: Can you share references or external links related to CVE-2020-1842?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1842?


Explain the CVE ID: What does the identifier CVE-2020-1843 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1843.

Huawei HEGE-560 version 1.0.1.20(SP2), OSCA-550 version 1.0.0.71(SP1), OSCA-550A version 1.0.0.71(SP1), OSCA-550AX version 1.0.0.71(SP2), and OSCA-550X version 1.0.0.71(SP2) have an insufficient verification vulnerability. An attacker can perform specific operations to exploit this vulnerability by physical access methods. Successful exploitation may cause the attacker perform an illegal operation.


Provide references for further information: Can you share references or external links related to CVE-2020-1843?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1843?


Explain the CVE ID: What does the identifier CVE-2020-1844 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1844.

PCManager with versions earlier than 10.0.5.51 have a privilege escalation vulnerability in Huawei PCManager products. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege.


Provide references for further information: Can you share references or external links related to CVE-2020-1844?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1844?


Explain the CVE ID: What does the identifier CVE-2020-1845 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1845.

Huawei PCManager product with versions earlier than 10.0.5.53 have a local privilege escalation vulnerability. An authenticated, local attacker can perform specific operation to exploit this vulnerability. Successful exploitation may cause the attacker to obtain a higher privilege.


Provide references for further information: Can you share references or external links related to CVE-2020-1845?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1845?


Explain the CVE ID: What does the identifier CVE-2020-1847 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1847.

There is a denial of service vulnerability in some Huawei products. There is no protection against the attack scenario of specific protocol. A remote, unauthorized attackers can construct attack scenarios, which leads to denial of service.Affected product versions include:NIP6300 versions V500R001C30,V500R001C60;NIP6600 versions V500R001C30,V500R001C60;Secospace USG6300 versions V500R001C30,V500R001C60;Secospace USG6500 versions V500R001C30,V500R001C60;Secospace USG6600 versions V500R001C30,V500R001C60;USG9500 versions V500R001C30,V500R001C60.


Provide references for further information: Can you share references or external links related to CVE-2020-1847?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1847?


Explain the CVE ID: What does the identifier CVE-2020-1848 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1848.

There is a resource management error vulnerability in Jackman-AL00D versions 8.2.0.185(C00R2P1). Local attackers construct malicious application files, causing system applications to run abnormally.


Provide references for further information: Can you share references or external links related to CVE-2020-1848?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1848?


Explain the CVE ID: What does the identifier CVE-2020-1853 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1853.

GaussDB 200 with version of 6.5.1 have a path traversal vulnerability. Due to insufficient input path validation, an authenticated attacker can traverse directories and download files to a specific directory. Successful exploit may cause information leakage.


Provide references for further information: Can you share references or external links related to CVE-2020-1853?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1853?


Explain the CVE ID: What does the identifier CVE-2020-1855 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1855.

Huawei HEGE-570 version 1.0.1.22(SP3); and HEGE-560, OSCA-550, OSCA-550A, OSCA-550AX, and OSCA-550X version 1.0.1.21(SP3) have an insufficient verification vulnerability. An attacker can access the device physically and exploit this vulnerability to tamper with device information. Successful exploit may cause service abnormal.


Provide references for further information: Can you share references or external links related to CVE-2020-1855?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1855?


Explain the CVE ID: What does the identifier CVE-2020-1856 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1856.

Huawei NGFW Module, NIP6300, NIP6600, Secospace USG6500, Secospace USG6600, and USG9500 versions V500R001C30, V500R001C60, and V500R005C00 have an information leakage vulnerability. An attacker can exploit this vulnerability by sending specific request packets to affected devices. Successful exploit may lead to information leakage.


Provide references for further information: Can you share references or external links related to CVE-2020-1856?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1856?


Explain the CVE ID: What does the identifier CVE-2020-1857 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1857.

Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; and Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have an information leakage vulnerability. Due to improper processing of some data, a local authenticated attacker can exploit this vulnerability through a series of operations. Successful exploitation may cause information leakage.


Provide references for further information: Can you share references or external links related to CVE-2020-1857?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1857?


Explain the CVE ID: What does the identifier CVE-2020-1858 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1858.

Huawei products NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00SPC100; Secospace USG6600 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100; and USG9500 versions V500R001C30SPC600, V500R001C60SPC500, and V500R005C00SPC100 have a denial of service vulnerability. Attackers need to perform a series of operations in a special scenario to exploit this vulnerability. Successful exploit may cause the new connections can't be established, result in a denial of service.


Provide references for further information: Can you share references or external links related to CVE-2020-1858?

{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200205-01-dos-en'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200219-04-dos-en'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1858?


Explain the CVE ID: What does the identifier CVE-2020-1860 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1860.

NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an access control bypass vulnerability. Attackers that can access to the internal network can exploit this vulnerability with careful deployment. Successful exploit may cause the access control to be bypassed, and attackers can directly access the Internet.


Provide references for further information: Can you share references or external links related to CVE-2020-1860?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1860?


Explain the CVE ID: What does the identifier CVE-2020-1861 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1861.

CloudEngine 12800 with versions of V200R001C00SPC600,V200R001C00SPC700,V200R002C01,V200R002C50SPC800,V200R002C50SPC800PWE,V200R003C00SPC810,V200R003C00SPC810PWE,V200R005C00SPC600,V200R005C00SPC800,V200R005C00SPC800PWE,V200R005C10,V200R005C10SPC300 have an information leakage vulnerability in some Huawei products. In some special cases, an authenticated attacker can exploit this vulnerability because the software processes data improperly. Successful exploitation may lead to information leakage.


Provide references for further information: Can you share references or external links related to CVE-2020-1861?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1861?


Explain the CVE ID: What does the identifier CVE-2020-1862 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1862.

There is a double free vulnerability in some Huawei products. A local attacker with low privilege may perform some operations to exploit the vulnerability. Due to doubly freeing memory, successful exploit may cause some service abnormal. Affected product versions include:CampusInsight versions V100R019C00;ManageOne versions 6.5.RC2.B050.


Provide references for further information: Can you share references or external links related to CVE-2020-1862?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1862?


Explain the CVE ID: What does the identifier CVE-2020-1863 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1863.

Huawei USG6000V with versions V500R001C20SPC300, V500R003C00SPC100, and V500R005C00SPC100 have an out-of-bounds read vulnerability. Due to a logical flaw in a JSON parsing routine, a remote, unauthenticated attacker could exploit this vulnerability to disrupt service in the affected products.


Provide references for further information: Can you share references or external links related to CVE-2020-1863?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1863?


Explain the CVE ID: What does the identifier CVE-2020-1864 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1864.

Some Huawei products have a security vulnerability due to improper authentication. A remote attacker needs to obtain some information and forge the peer device to send specific packets to the affected device. Due to the improper implementation of the authentication function, attackers can exploit the vulnerability to connect to affected devices and execute a series of commands.Affected product versions include:Secospace AntiDDoS8000 versions V500R001C00,V500R001C20,V500R001C60,V500R005C00.


Provide references for further information: Can you share references or external links related to CVE-2020-1864?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1864?


Explain the CVE ID: What does the identifier CVE-2020-1865 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1865.

There is an out-of-bounds read vulnerability in Huawei CloudEngine products. The software reads data past the end of the intended buffer when parsing certain PIM message, an adjacent attacker could send crafted PIM messages to the device, successful exploit could cause out of bounds read when the system does the certain operation.


Provide references for further information: Can you share references or external links related to CVE-2020-1865?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1865?


Explain the CVE ID: What does the identifier CVE-2020-1866 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1866.

There is an out-of-bounds read vulnerability in several products. The software reads data past the end of the intended buffer when parsing certain crafted DHCP messages. Successful exploit could cause certain service abnormal. Affected product versions include:NIP6800 versions V500R001C30,V500R001C60SPC500,V500R005C00;S12700 versions V200R008C00;S2700 versions V200R008C00;S5700 versions V200R008C00;S6700 versions V200R008C00;S7700 versions V200R008C00;S9700 versions V200R008C00;Secospace USG6600 versions V500R001C30SPC200,V500R001C30SPC600,V500R001C60SPC500,V500R005C00;USG9500 versions V500R001C30SPC300,V500R001C30SPC600,V500R001C60SPC500,V500R005C00.


Provide references for further information: Can you share references or external links related to CVE-2020-1866?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1866?


Explain the CVE ID: What does the identifier CVE-2020-1870 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1870.

There is a denial of service vulnerability in some Huawei products. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service. Affected product versions include: CloudEngine 12800 versions V200R019C00SPC800; CloudEngine 5800 versions V200R019C00SPC800; CloudEngine 6800 versions V200R005C20SPC800, V200R019C00SPC800; CloudEngine 7800 versions V200R019C00SPC800; NE40E versions V800R011C00SPC200, V800R011C00SPC300, V800R011C10SPC100; NE40E-F versions V800R011C00SPC200, V800R011C10SPC100; NE40E-M versions V800R011C00SPC200, V800R011C10SPC100.


Provide references for further information: Can you share references or external links related to CVE-2020-1870?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1870?


Explain the CVE ID: What does the identifier CVE-2020-1871 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1871.

USG9500 with software of V500R001C30SPC100; V500R001C30SPC200; V500R001C30SPC600; V500R001C60SPC500; V500R005C00SPC100; V500R005C00SPC200 have an improper credentials management vulnerability. The software does not properly manage certain credentials. Successful exploit could cause information disclosure or damage, and impact the confidentiality or integrity.


Provide references for further information: Can you share references or external links related to CVE-2020-1871?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1871?


Explain the CVE ID: What does the identifier CVE-2020-1872 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1872.

Huawei smart phones P10 Plus with versions earlier than 9.1.0.201(C01E75R1P12T8), earlier than 9.1.0.252(C185E2R1P9T8), earlier than 9.1.0.252(C432E4R1P9T8), and earlier than 9.1.0.255(C576E6R1P8T8) have a digital balance bypass vulnerability. When re-configuring the mobile phone at the digital balance mode, an attacker can perform some operations to bypass the startup wizard, and then open some switch. As a result, the digital balance function is bypassed.


Provide references for further information: Can you share references or external links related to CVE-2020-1872?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1872?


Explain the CVE ID: What does the identifier CVE-2020-1873 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1873.

NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds read vulnerability. An unauthenticated attacker crafts malformed message with specific parameter and sends the message to the affected products. Due to insufficient validation of message, which may be exploited to cause the device reboot.


Provide references for further information: Can you share references or external links related to CVE-2020-1873?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1873?


Explain the CVE ID: What does the identifier CVE-2020-1874 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1874.

NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have a invalid pointer access vulnerability. The software system access an invalid pointer when operator logs in to the device and performs some operations. Successful exploit could cause certain process reboot.


Provide references for further information: Can you share references or external links related to CVE-2020-1874?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1874?


Explain the CVE ID: What does the identifier CVE-2020-1875 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1875.

NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerability. The software system access an invalid pointer when an abnormal condition occurs in certain operation. Successful exploit could cause certain process reboot. Affected product versions include:NIP6800 versions V500R001C30,V500R001C60SPC500;Secospace USG6600 versions V500R001C30SPC200,V500R001C30SPC600,V500R001C60SPC500;USG9500 versions V500R001C30SPC200,V500R001C30SPC600,V500R001C60SPC500.


Provide references for further information: Can you share references or external links related to CVE-2020-1875?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1875?


Explain the CVE ID: What does the identifier CVE-2020-1876 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1876.

NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds write vulnerability. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validation of packets, which may be exploited to cause the process reboot.


Provide references for further information: Can you share references or external links related to CVE-2020-1876?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1876?


Explain the CVE ID: What does the identifier CVE-2020-1877 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1877.

NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an invalid pointer access vulnerability. The software system access an invalid pointer when administrator log in to the device and performs some operations. Successful exploit could cause certain process reboot.


Provide references for further information: Can you share references or external links related to CVE-2020-1877?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1877?


Explain the CVE ID: What does the identifier CVE-2020-1878 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1878.

Huawei smartphone OxfordS-AN00A with versions earlier than 10.0.1.152D(C735E152R3P3),versions earlier than 10.0.1.160(C00E160R4P1) have an improper authentication vulnerability. Authentication to target component is improper when device performs an operation. Attackers exploit this vulnerability to obtain some information by loading malicious application, leading to information leak.


Provide references for further information: Can you share references or external links related to CVE-2020-1878?

{'tags': ['x_refsource_MISC'], 'url': 'https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200311-01-informationleak-en'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-dos-en'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1878?


Explain the CVE ID: What does the identifier CVE-2020-1879 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1879.

There is an improper integrity checking vulnerability on some huawei products. The software of the affected product has an improper integrity check which may allow an attacker with high privilege to make malicious modifications.Affected product versions include:HEGE-560 versions 1.0.1.21(SP3);HEGE-570 versions 1.0.1.22(SP3);OSCA-550 versions 1.0.1.21(SP3);OSCA-550A versions 1.0.1.21(SP3);OSCA-550AX versions 1.0.1.21(SP3);OSCA-550X versions 1.0.1.21(SP3).


Provide references for further information: Can you share references or external links related to CVE-2020-1879?

{'tags': ['x_refsource_MISC'], 'url': 'https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200311-01-integrity-en'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200415-02-dos-en'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1879?


Explain the CVE ID: What does the identifier CVE-2020-1880 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1880.

Huawei smartphone Lion-AL00C with versions earlier than 10.0.0.205(C00E202R7P2) have a denial of service vulnerability. An attacker crafted specially file to the affected device. Due to insufficient input validation of the value when executing the file, successful exploit may cause device abnormal.


Provide references for further information: Can you share references or external links related to CVE-2020-1880?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1880?


Explain the CVE ID: What does the identifier CVE-2020-1881 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1881.

NIP6800;Secospace USG6600;USG9500 products with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have have a resource management error vulnerability. An attacker needs to perform specific operations to trigger a function of the affected device. Due to improper resource management of the function, the vulnerability can be exploited to cause service abnormal on affected devices.


Provide references for further information: Can you share references or external links related to CVE-2020-1881?

{'tags': ['x_refsource_MISC'], 'url': 'https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200219-02-resource-en'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200429-01-invalidpointer-en'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1881?


Explain the CVE ID: What does the identifier CVE-2020-1882 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1882.

Huawei mobile phones Ever-L29B versions earlier than 10.0.0.180(C185E6R3P3), earlier than 10.0.0.180(C432E6R1P7), earlier than 10.0.0.180(C636E5R2P3); HUAWEI Mate 20 RS versions earlier than 10.0.0.175(C786E70R3P8); HUAWEI Mate 20 X versions earlier than 10.0.0.176(C00E70R2P8); and Honor Magic2 versions earlier than 10.0.0.175(C00E59R2P11) have an improper authorization vulnerability. Due to improper authorization of some function, attackers can bypass the authorization to perform some operations.


Provide references for further information: Can you share references or external links related to CVE-2020-1882?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1882?


Explain the CVE ID: What does the identifier CVE-2020-1883 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1883.

Huawei products NIP6800;Secospace USG6600;USG9500 have a memory leak vulnerability. An attacker with high privileges exploits this vulnerability by continuously performing specific operations. Successful exploitation of this vulnerability can cause service abnormal.


Provide references for further information: Can you share references or external links related to CVE-2020-1883?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1883?


Explain the CVE ID: What does the identifier CVE-2020-1885 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1885.

Writing to an unprivileged file from a privileged OVRRedir.exe process in Oculus Desktop before 1.44.0.32849 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file.


Provide references for further information: Can you share references or external links related to CVE-2020-1885?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1885'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1885?


Explain the CVE ID: What does the identifier CVE-2020-1886 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1886.

A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a specially crafted video stream after receiving and answering a malicious video call.


Provide references for further information: Can you share references or external links related to CVE-2020-1886?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.whatsapp.com/security/advisories/2020'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1886?


Explain the CVE ID: What does the identifier CVE-2020-1887 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1887.

Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust.


Provide references for further information: Can you share references or external links related to CVE-2020-1887?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osquery/osquery/pull/6197'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1887'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1887?


Explain the CVE ID: What does the identifier CVE-2020-1888 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1888.

Insufficient boundary checks when decoding JSON in handleBackslash reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.


Provide references for further information: Can you share references or external links related to CVE-2020-1888?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hhvm/commit/b3679121bb3c7017ff04b4c08402ffff5cf59b13'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://hhvm.com/blog/2020/02/20/security-update.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1888?


Explain the CVE ID: What does the identifier CVE-2020-1889 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1889.

A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in Electron and escalation of privilege if combined with a remote code execution vulnerability inside the sandboxed renderer process.


Provide references for further information: Can you share references or external links related to CVE-2020-1889?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.whatsapp.com/security/advisories/2020/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1889?


Explain the CVE ID: What does the identifier CVE-2020-1890 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1890.

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction.


Provide references for further information: Can you share references or external links related to CVE-2020-1890?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1890?


Explain the CVE ID: What does the identifier CVE-2020-1891 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1891.

A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices.


Provide references for further information: Can you share references or external links related to CVE-2020-1891?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1891?


Explain the CVE ID: What does the identifier CVE-2020-1892 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1892.

Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to information leak and DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.


Provide references for further information: Can you share references or external links related to CVE-2020-1892?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hhvm.com/blog/2020/02/20/security-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hhvm/commit/dabd48caf74995e605f1700344f1ff4a5d83441d'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1892?


Explain the CVE ID: What does the identifier CVE-2020-1893 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1893.

Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM 4.45.0, 4.44.0, 4.43.0, 4.42.0, 4.41.0, 4.40.0, 4.39.0, versions between 4.33.0 and 4.38.0 (inclusive), versions between 4.9.0 and 4.32.0 (inclusive), and versions prior to 4.8.7.


Provide references for further information: Can you share references or external links related to CVE-2020-1893?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hhvm.com/blog/2020/02/20/security-update.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hhvm/commit/bd586671a3c22eb2f07e55f11b3ce64e1f7961e7'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1893?


Explain the CVE ID: What does the identifier CVE-2020-1894 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1894.

A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30 could have allowed arbitrary code execution when playing a specially crafted push to talk message.


Provide references for further information: Can you share references or external links related to CVE-2020-1894?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1894?


Explain the CVE ID: What does the identifier CVE-2020-1895 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1895.

A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128.


Provide references for further information: Can you share references or external links related to CVE-2020-1895?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1895'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1895?


Explain the CVE ID: What does the identifier CVE-2020-1896 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1896.

A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2) allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.


Provide references for further information: Can you share references or external links related to CVE-2020-1896?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1896'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1896?


Explain the CVE ID: What does the identifier CVE-2020-1897 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1897.

A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error handling in a specific sequence. This issue affects versions of proxygen prior to v2020.05.18.00.


Provide references for further information: Can you share references or external links related to CVE-2020-1897?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1897'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1897?


Explain the CVE ID: What does the identifier CVE-2020-1898 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1898.

The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1898?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hhvm.com/blog/2020/06/30/security-update.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1898?


Explain the CVE ID: What does the identifier CVE-2020-1899 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1899.

The unserialize() function supported a type code, "S", which was meant to be supported only for APC serialization. This type code allowed arbitrary memory addresses to be accessed as if they were static StringData objects. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1899?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hhvm.com/blog/2020/06/30/security-update.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/facebook/hhvm/commit/1107228a5128d3ca1c4add8ac1635d933cbbe2e9'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1899?


Explain the CVE ID: What does the identifier CVE-2020-1900 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1900.

When unserializing an object with dynamic properties HHVM needs to pre-reserve the full size of the dynamic property array before inserting anything into it. Otherwise the array might resize, invalidating previously stored references. This pre-reservation was not occurring in HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1900?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hhvm.com/blog/2020/06/30/security-update.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/facebook/hhvm/commit/c1c4bb0cf9e076aafaf4ff3515556ef9faf906f3'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1900?


Explain the CVE ID: What does the identifier CVE-2020-1901 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1901.

Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message.


Provide references for further information: Can you share references or external links related to CVE-2020-1901?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.whatsapp.com/security/advisories/2020/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1901?


Explain the CVE ID: What does the identifier CVE-2020-1902 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1902.

A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP.


Provide references for further information: Can you share references or external links related to CVE-2020-1902?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1902?


Explain the CVE ID: What does the identifier CVE-2020-1903 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1903.

An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.


Provide references for further information: Can you share references or external links related to CVE-2020-1903?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1903?


Explain the CVE ID: What does the identifier CVE-2020-1904 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1904.

A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages.


Provide references for further information: Can you share references or external links related to CVE-2020-1904?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1904?


Explain the CVE ID: What does the identifier CVE-2020-1905 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1905.

Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious third party app chosen to open the file to guess the URIs for previously opened attachments until the opener app is terminated.


Provide references for further information: Can you share references or external links related to CVE-2020-1905?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1905?


Explain the CVE ID: What does the identifier CVE-2020-1906 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1906.

A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when processing malformed local videos with E-AC-3 audio streams.


Provide references for further information: Can you share references or external links related to CVE-2020-1906?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1906?


Explain the CVE ID: What does the identifier CVE-2020-1907 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1907.

A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header.


Provide references for further information: Can you share references or external links related to CVE-2020-1907?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1907?


Explain the CVE ID: What does the identifier CVE-2020-1908 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1908.

Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp application even after the phone was locked.


Provide references for further information: Can you share references or external links related to CVE-2020-1908?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1908?


Explain the CVE ID: What does the identifier CVE-2020-1909 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1909.

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold.


Provide references for further information: Can you share references or external links related to CVE-2020-1909?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1909?


Explain the CVE ID: What does the identifier CVE-2020-1910 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1910.

A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read and write if a user applied specific image filters to a specially crafted image and sent the resulting image.


Provide references for further information: Can you share references or external links related to CVE-2020-1910?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.whatsapp.com/security/advisories/2021/'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1910?


Explain the CVE ID: What does the identifier CVE-2020-1911 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1911.

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.


Provide references for further information: Can you share references or external links related to CVE-2020-1911?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1911'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hermes/commit/fe52854cdf6725c2eaa9e125995da76e6ceb27da'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1911?


Explain the CVE ID: What does the identifier CVE-2020-1912 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1912.

An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.


Provide references for further information: Can you share references or external links related to CVE-2020-1912?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1912'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hermes/commit/091835377369c8fd5917d9b87acffa721ad2a168'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1912?


Explain the CVE ID: What does the identifier CVE-2020-1913 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1913.

An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.


Provide references for further information: Can you share references or external links related to CVE-2020-1913?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1913'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1913?


Explain the CVE ID: What does the identifier CVE-2020-1914 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1914.

A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.


Provide references for further information: Can you share references or external links related to CVE-2020-1914?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1914'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hermes/commit/b2021df620824627f5a8c96615edbd1eb7fdddfc'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1914?


Explain the CVE ID: What does the identifier CVE-2020-1915 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1915.

An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.


Provide references for further information: Can you share references or external links related to CVE-2020-1915?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.facebook.com/security/advisories/cve-2020-1915'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/hermes/commit/8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1915?


Explain the CVE ID: What does the identifier CVE-2020-1916 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1916.

An incorrect size calculation in ldap_escape may lead to an integer overflow when overly long input is passed in, resulting in an out-of-bounds write. This issue affects HHVM prior to 4.56.2, all versions between 4.57.0 and 4.78.0, 4.79.0, 4.80.0, 4.81.0, 4.82.0, 4.83.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1916?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://hhvm.com/blog/2020/11/12/security-update.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/facebook/hhvm/commit/abe0b29e4d3a610f9bc920b8be4ad8403364c2d4'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1916?


Explain the CVE ID: What does the identifier CVE-2020-1917 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1917.

xbuf_format_converter, used as part of exif_read_data, was appending a terminating null character to the generated string, but was not using its standard append char function. As a result, if the buffer was full, it would result in an out-of-bounds write. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1917?

{'tags': ['x_refsource_MISC'], 'url': 'https://hhvm.com/blog/2021/02/25/security-update.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/facebook/hhvm/commit/08193b7f0cd3910256e00d599f0f3eb2519c44ca'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1917?


Explain the CVE ID: What does the identifier CVE-2020-1918 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1918.

In-memory file operations (ie: using fopen on a data URI) did not properly restrict negative seeking, allowing for the reading of memory prior to the in-memory buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1918?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1918?


Explain the CVE ID: What does the identifier CVE-2020-1919 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1919.

Incorrect bounds calculations in substr_compare could lead to an out-of-bounds read when the second string argument passed in is longer than the first. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1919?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1919?


Explain the CVE ID: What does the identifier CVE-2020-1920 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1920.

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.


Provide references for further information: Can you share references or external links related to CVE-2020-1920?

{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/facebook/react-native/releases/tag/v0.64.1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/facebook/react-native/commit/ca09ae82715e33c9ac77b3fa55495cf84ba891c7'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1920?


Explain the CVE ID: What does the identifier CVE-2020-1921 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1921.

In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.


Provide references for further information: Can you share references or external links related to CVE-2020-1921?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1921?


Explain the CVE ID: What does the identifier CVE-2020-1925 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1925.

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.


Provide references for further information: Can you share references or external links related to CVE-2020-1925?


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1925?


Explain the CVE ID: What does the identifier CVE-2020-1926 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1926.

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8


Provide references for further information: Can you share references or external links related to CVE-2020-1926?

{'tags': ['x_refsource_MISC'], 'url': 'https://issues.apache.org/jira/browse/HIVE-22708'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lists.apache.org/thread.html/rd186eedff68102ba1e68059a808101c5aa587e11542c7dcd26e7b9d7%40%3Cuser.hive.apache.org%3E'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1926?


Explain the CVE ID: What does the identifier CVE-2020-1927 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1927.

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.


Provide references for further information: Can you share references or external links related to CVE-2020-1927?

{'name': '[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2020/04/03/1'}, {'name': '[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2020/04/04/1'}, {'name': '[httpd-dev] 20200404 Odd vulnerabilities_24.html output', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E'}, {'name': '[httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20200411 svn commit: r1876405 - in /httpd/test/framework/trunk/t: conf/core.conf.in security/CVE-2020-1927.t', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20200412 svn commit: r1876426 - /httpd/test/framework/trunk/t/security/CVE-2020-1927.t', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e%40%3Ccvs.httpd.apache.org%3E'}, {'name': 'openSUSE-SU-2020:0597', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujul2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://httpd.apache.org/security/vulnerabilities_24.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20200413-0002/'}, {'name': 'USN-4458-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4458-1/'}, {'name': 'FEDORA-2020-189a1e6c3e', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/'}, {'name': 'DSA-4757', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2020/dsa-4757'}, {'name': 'FEDORA-2020-0d3d3f5072', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/'}, {'name': '[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1073158 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1927.json security/vulnerabilities_24.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210330 svn commit: r1888215 - /httpd/site/trunk/content/security/json/CVE-2020-1927.json', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84%40%3Ccvs.httpd.apache.org%3E'}, {'name': '[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpuApr2021.html'}, {'name': '[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujul2022.html'}


Explain the state of this CVE: What is the publication or resolution state of CVE-2020-1927?


Explain the CVE ID: What does the identifier CVE-2020-1928 mean in the context of cybersecurity?


Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2020-1928.

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.