Security Vulnerabilities - CVEs Published In December 2020
Every login in tangro Business Workflow before 1.18.1 generates the same JWT token, which allows an attacker to reuse the token when a session is active. The JWT token does not contain an expiration timestamp.
CVSS Score
4.2
EPSS Score
0.007
Published
2020-12-18
An incorrect access control implementation in Tangro Business Workflow before 1.18.1 allows an attacker to download documents (PDF) by providing a valid document ID and token. No further authentication is required.
CVSS Score
3.1
EPSS Score
0.007
Published
2020-12-18
tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser (client-side) and can be circumvented. This allows an attacker to upload any file as an attachment to a workitem.
CVSS Score
8.8
EPSS Score
0.012
Published
2020-12-18
An issue was discovered in the GPS daemon on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (non-Qualcomm chipsets) software. Attackers can obtain sensitive location information because the configuration file is incorrect. The Samsung ID is SVE-2020-18678 (December 2020).
CVSS Score
5.3
EPSS Score
0.003
Published
2020-12-18
An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets) software. They allows attackers to cause a denial of service (unlock failure) by triggering a power-shortage incident that causes a false-positive attack detection. The Samsung ID is SVE-2020-19678 (December 2020).
CVSS Score
7.5
EPSS Score
0.004
Published
2020-12-18
An issue was discovered on LG mobile devices with Android OS 8.0, 8.1, 9.0, and 10 software. There is a WebView SSL error-handler vulnerability. The LG ID is LVE-SMP-200026 (December 2020).
CVSS Score
7.8
EPSS Score
0.001
Published
2020-12-18
An issue was discovered on LG mobile devices with Android OS 10 software. When a dual-screen configuration is supported, the device does not lock upon disconnection of a call with the cover closed. The LG ID is LVE-SMP-200027 (December 2020).
CVSS Score
7.8
EPSS Score
0.001
Published
2020-12-18
SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request.
CVSS Score
5.4
EPSS Score
0.017
Published
2020-12-18
SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account.
CVSS Score
5.4
EPSS Score
0.015
Published
2020-12-18
An issue was discovered in Finder on Samsung mobile devices with Q(10.0) software. A call to a non-existent provider allows attackers to cause a denial of service. The Samsung ID is SVE-2020-18629 (December 2020).
CVSS Score
5.5
EPSS Score
0.001
Published
2020-12-18