Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2019-1397
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1389, CVE-2019-1398.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1397'}]
CVE State: PUBLISHED
Explain CVE-2019-1398
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1389, CVE-2019-1397.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1398'}]
CVE State: PUBLISHED
Explain CVE-2019-1399
A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0712, CVE-2019-1309, CVE-2019-1310.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1399'}]
CVE State: PUBLISHED
Explain CVE-2019-1400
An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1463.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1400'}]
CVE State: PUBLISHED
Explain CVE-2019-1402
An information disclosure vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka 'Microsoft Office Information Disclosure Vulnerability'.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1402'}]
CVE State: PUBLISHED
Explain CVE-2019-1405
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1406
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1406'}]
CVE State: PUBLISHED
Explain CVE-2019-1407
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1433, CVE-2019-1435, CVE-2019-1437, CVE-2019-1438.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1407'}]
CVE State: PUBLISHED
Explain CVE-2019-1408
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1393, CVE-2019-1394, CVE-2019-1395, CVE-2019-1396, CVE-2019-1434.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1408'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-976/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1016/'}]
CVE State: PUBLISHED
Explain CVE-2019-1409
An information disclosure vulnerability exists when the Windows Remote Procedure Call (RPC) runtime improperly initializes objects in memory, aka 'Windows Remote Procedure Call Information Disclosure Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1409'}]
CVE State: PUBLISHED
Explain CVE-2019-1411
An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1432.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1411'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-973/'}]
CVE State: PUBLISHED
Explain CVE-2019-1412
An information disclosure vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle objects in memory, aka 'OpenType Font Driver Information Disclosure Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1412'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-980/'}]
CVE State: PUBLISHED
Explain CVE-2019-1413
A security feature bypass vulnerability exists when Microsoft Edge improperly handles extension requests and fails to request host permission for all_urls, aka 'Microsoft Edge Security Feature Bypass Vulnerability'.
Affected Products: Microsoft Edge (EdgeHTML-based) on Windows Server 2016
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1413'}]
CVE State: PUBLISHED
Explain CVE-2019-1414
An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege Vulnerability'.
Affected Products: Visual Studio Code
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1414'}]
CVE State: PUBLISHED
Explain CVE-2019-1415
An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operations.To exploit the vulnerability, an attacker would require unprivileged execution on the victim system, aka 'Windows Installer Elevation of Privilege Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1415'}]
CVE State: PUBLISHED
Explain CVE-2019-1416
An elevation of privilege vulnerability exists due to a race condition in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1416'}]
CVE State: PUBLISHED
Explain CVE-2019-1417
An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data Sharing Service Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1379, CVE-2019-1383.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1417'}]
CVE State: PUBLISHED
Explain CVE-2019-1418
An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Information Disclosure Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1418'}]
CVE State: PUBLISHED
Explain CVE-2019-1419
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts, aka 'OpenType Font Parsing Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1456.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1419'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-977/'}]
CVE State: PUBLISHED
Explain CVE-2019-1420
An elevation of privilege vulnerability exists in the way that the dssvc.dll handles file creation allowing for a file overwrite or creation in a secured location, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1422, CVE-2019-1423.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1420'}]
CVE State: PUBLISHED
Explain CVE-2019-1422
An elevation of privilege vulnerability exists in the way that the iphlpsvc.dll handles file creation allowing for a file overwrite, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1420, CVE-2019-1423.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1422'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-972/'}]
CVE State: PUBLISHED
Explain CVE-2019-1423
An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1420, CVE-2019-1422.
Affected Products: Windows 10 Version 1903 for 32-bit Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1423'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-978/'}]
CVE State: PUBLISHED
Explain CVE-2019-1424
A security feature bypass vulnerability exists when Windows Netlogon improperly handles a secure communications channel, aka 'NetLogon Security Feature Bypass Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1424'}]
CVE State: PUBLISHED
Explain CVE-2019-1425
An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files, aka 'Visual Studio Elevation of Privilege Vulnerability'.
Affected Products: Microsoft Visual Studio 2017
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1425'}]
CVE State: PUBLISHED
Explain CVE-2019-1426
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1427, CVE-2019-1428, CVE-2019-1429.
Affected Products: Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1426'}]
CVE State: PUBLISHED
Explain CVE-2019-1427
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1428, CVE-2019-1429.
Affected Products: Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1427'}]
CVE State: PUBLISHED
Explain CVE-2019-1428
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1429.
Affected Products: Microsoft Edge (EdgeHTML-based) on Windows Server 2016
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1428'}]
CVE State: PUBLISHED
Explain CVE-2019-1429
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.
Affected Products: Internet Explorer 9
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/155433/Microsoft-Internet-Explorer-Use-After-Free.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1430
A remote code execution vulnerability exists when Windows Media Foundation improperly parses specially crafted QuickTime media files.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'Microsoft Windows Media Foundation Remote Code Execution Vulnerability'.
Affected Products: Windows 10 Version 1903 for 32-bit Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1430'}]
CVE State: PUBLISHED
Explain CVE-2019-1432
An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1411.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1432'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-974/'}]
CVE State: PUBLISHED
Explain CVE-2019-1433
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1435, CVE-2019-1437, CVE-2019-1438.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1433'}]
CVE State: PUBLISHED
Explain CVE-2019-1434
An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1393, CVE-2019-1394, CVE-2019-1395, CVE-2019-1396, CVE-2019-1408.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1434'}]
CVE State: PUBLISHED
Explain CVE-2019-1435
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1433, CVE-2019-1437, CVE-2019-1438.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1435'}]
CVE State: PUBLISHED
Explain CVE-2019-1436
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1440.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1436'}]
CVE State: PUBLISHED
Explain CVE-2019-1437
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1433, CVE-2019-1435, CVE-2019-1438.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1437'}]
CVE State: PUBLISHED
Explain CVE-2019-1438
An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1407, CVE-2019-1433, CVE-2019-1435, CVE-2019-1437.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1438'}]
CVE State: PUBLISHED
Explain CVE-2019-1439
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1439'}]
CVE State: PUBLISHED
Explain CVE-2019-1440
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1436.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1440'}]
CVE State: PUBLISHED
Explain CVE-2019-1441
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1441'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-985/'}]
CVE State: PUBLISHED
Explain CVE-2019-1442
A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.
Affected Products: Microsoft SharePoint Server
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1442'}]
CVE State: PUBLISHED
Explain CVE-2019-1443
An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated attacker who successfully exploited this vulnerability could potentially leverage SharePoint functionality to obtain SMB hashes.The security update addresses the vulnerability by correcting how SharePoint checks file content., aka 'Microsoft SharePoint Information Disclosure Vulnerability'.
Affected Products: Microsoft SharePoint Foundation
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1443'}]
CVE State: PUBLISHED
Explain CVE-2019-1445
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447.
Affected Products: Office Online Server
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1445'}]
CVE State: PUBLISHED
Explain CVE-2019-1446
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
Affected Products: Microsoft Excel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1446'}]
CVE State: PUBLISHED
Explain CVE-2019-1447
A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1445.
Affected Products: Office Online Server
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1447'}]
CVE State: PUBLISHED
Explain CVE-2019-1448
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
Affected Products: Microsoft Excel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1448'}]
CVE State: PUBLISHED
Explain CVE-2019-1449
A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which could lead to a standard user, any AppContainer sandbox, and Office LPAC Protected View to escalate privileges to SYSTEM.To exploit this bug, an attacker would have to run a specially crafted file, aka 'Microsoft Office ClickToRun Security Feature Bypass Vulnerability'.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1449'}]
CVE State: PUBLISHED
Explain CVE-2019-1453
A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability'.
Affected Products: Windows 10 Version 1909 for 32-bit Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1453'}]
CVE State: PUBLISHED
Explain CVE-2019-1454
An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1454'}]
CVE State: PUBLISHED
Explain CVE-2019-1456
A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts, aka 'OpenType Font Parsing Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1419.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1456'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-986/'}]
CVE State: PUBLISHED
Explain CVE-2019-1457
A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel Security Feature Bypass'.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1457'}]
CVE State: PUBLISHED
Explain CVE-2019-1458
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/156651/Microsoft-Windows-WizardOpium-Local-Privilege-Escalation.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/159569/Microsoft-Windows-Uninitialized-Variable-Local-Privilege-Escalation.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1460
A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
Affected Products: Microsoft Outlook for Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460'}]
CVE State: PUBLISHED
Explain CVE-2019-1461
A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of Service Vulnerability'.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1461'}]
CVE State: PUBLISHED
Explain CVE-2019-1462
A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code Execution Vulnerability'.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1462'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1006/'}]
CVE State: PUBLISHED
Explain CVE-2019-1463
An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1400.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1463'}]
CVE State: PUBLISHED
Explain CVE-2019-1464
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
Affected Products: Microsoft Office
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1464'}]
CVE State: PUBLISHED
Explain CVE-2019-1465
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1466, CVE-2019-1467.
Affected Products: Windows 10 Version 1909 for ARM64-based Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1465'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1008/'}]
CVE State: PUBLISHED
Explain CVE-2019-1466
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1467.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1466'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1007/'}]
CVE State: PUBLISHED
Explain CVE-2019-1467
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1466.
Affected Products: Windows Server, version 1909 (Server Core installation)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1467'}]
CVE State: PUBLISHED
Explain CVE-2019-1468
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'.
Affected Products: Windows 10 Version 1909 for x64-based Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1468'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1004/'}]
CVE State: PUBLISHED
Explain CVE-2019-1469
An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1469'}]
CVE State: PUBLISHED
Explain CVE-2019-1470
An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1470'}]
CVE State: PUBLISHED
Explain CVE-2019-1471
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1471'}]
CVE State: PUBLISHED
Explain CVE-2019-1472
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1474.
Affected Products: Windows 10 Version 1909 for 32-bit Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1472'}]
CVE State: PUBLISHED
Explain CVE-2019-1474
An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1472.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1474'}]
CVE State: PUBLISHED
Explain CVE-2019-1476
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1483.
Affected Products: Windows 10 Version 1909 for ARM64-based Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1476'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/155653/AppXSvc-17763-Arbitrary-File-Overwrite.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1477
An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Printer Service Elevation of Privilege Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1477'}]
CVE State: PUBLISHED
Explain CVE-2019-1478
An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1478'}]
CVE State: PUBLISHED
Explain CVE-2019-1480
An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1481.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1480'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1002/'}]
CVE State: PUBLISHED
Explain CVE-2019-1481
An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1480.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1481'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1003/'}]
CVE State: PUBLISHED
Explain CVE-2019-1483
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1476.
Affected Products: Windows 10 Version 1909 for ARM64-based Systems
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1483'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.zerodayinitiative.com/advisories/ZDI-19-1005/'}]
CVE State: PUBLISHED
Explain CVE-2019-1484
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1484'}]
CVE State: PUBLISHED
Explain CVE-2019-1485
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'.
Affected Products: Internet Explorer 10
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1485'}]
CVE State: PUBLISHED
Explain CVE-2019-1486
A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the session host, aka 'Visual Studio Live Share Spoofing Vulnerability'.
Affected Products: Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1486'}]
CVE State: PUBLISHED
Explain CVE-2019-1487
An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under specific conditions, aka 'Microsoft Authentication Library for Android Information Disclosure Vulnerability'.
Affected Products: Microsoft Authentication Library (MSAL) for Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1487'}]
CVE State: PUBLISHED
Explain CVE-2019-1488
A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers, aka 'Microsoft Defender Security Feature Bypass Vulnerability'.
Affected Products: Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1488'}]
CVE State: PUBLISHED
Explain CVE-2019-1489
An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop Protocol Information Disclosure Vulnerability'.
Affected Products: Microsoft Windows XP Service Pack 3
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1489'}]
CVE State: PUBLISHED
Explain CVE-2019-1490
A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofing Vulnerability'.
Affected Products: Skype for Business Server 2019  CU2
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1490'}]
CVE State: PUBLISHED
Explain CVE-2019-1549
OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
Affected Products: OpenSSL
References: [{'name': 'FEDORA-2019-d15aac6c4e', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GY6SNRJP2S7Y42GIIDO3HXPNMDYN2U3A/'}, {'name': 'FEDORA-2019-d51641f152', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZN4VVQJ3JDCHGIHV4Y2YTXBYQZ6PWQ7E/'}, {'name': '20191001 [SECURITY] [DSA 4539-1] openssl security update', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://seclists.org/bugtraq/2019/Oct/1'}, {'name': 'DSA-4539', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2019/dsa-4539'}, {'name': 'USN-4376-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/4376-1/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujul2020.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.openssl.org/news/secadv/20190910.txt'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20190919-0002/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1b0fe00e2704b5e20334a16d3c9099d1ba2ef1be'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.f5.com/csp/article/K44070243'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.f5.com/csp/article/K44070243?utm_source=f5support&amp%3Butm_medium=RSS'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpuoct2020.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1565
The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next Generation Firewall with write privileges to External Dynamic List configuration to inject arbitrary JavaScript or HTML.
Affected Products: Palo Alto Networks PAN-OS
References: [{'name': '106752', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106752'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1565'}]
CVE State: PUBLISHED
Explain CVE-2019-1566
The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML.
Affected Products: Palo Alto Networks PAN-OS
References: [{'name': '106750', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106750'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1566'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.purplemet.com/blog/palo-alto-firewall-multiple-xss-vulnerabilities'}]
CVE State: PUBLISHED
Explain CVE-2019-1567
The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings.
Affected Products: Palo Alto Networks Expedition Migration Tool
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1567'}]
CVE State: PUBLISHED
Explain CVE-2019-1568
Cross-site scripting (XSS) vulnerability in Palo Alto Networks Demisto 4.5 build 40249 may allow an unauthenticated attacker to run arbitrary JavaScript or HTML.
Affected Products: Demisto
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1568'}]
CVE State: PUBLISHED
Explain CVE-2019-1569
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings for account name of admin user.
Affected Products: Palo Alto Networks Expedition Migration Tool
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2019-13'}, {'name': '107564', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107564'}, {'tags': ['x_refsource_MISC'], 'url': 'https://securityadvisories.paloaltonetworks.com/Home/Detail/142'}]
CVE State: PUBLISHED
Explain CVE-2019-1570
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the LDAP server settings.
Affected Products: Palo Alto Networks Expedition Migration Tool
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://securityadvisories.paloaltonetworks.com/Home/Detail/142'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2019-13'}, {'name': '107564', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107564'}]
CVE State: PUBLISHED
Explain CVE-2019-1571
The Expedition Migration tool 1.1.8 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the RADIUS server settings.
Affected Products: Palo Alto Networks Expedition Migration Tool
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://securityadvisories.paloaltonetworks.com/Home/Detail/142'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/research/tra-2019-13'}, {'name': '107564', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107564'}]
CVE State: PUBLISHED
Explain CVE-2019-1572
PAN-OS 9.0.0 may allow an unauthenticated remote user to access php files.
Affected Products: PAN-OS
References: [{'name': '107720', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107720'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1572'}]
CVE State: PUBLISHED
Explain CVE-2019-1573
GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS may allow a local authenticated attacker who has compromised the end-user account and gained the ability to inspect memory, to access authentication and/or session tokens and replay them to spoof the VPN session and gain access as the user.
Affected Products: GlobalProtect Agent
References: [{'name': 'VU#192371', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'https://www.kb.cert.org/vuls/id/192371'}, {'name': '107868', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107868'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0005'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-783'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1573'}]
CVE State: PUBLISHED
Explain CVE-2019-1574
Cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition Migration tool 1.1.12 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the Devices View.
Affected Products: Expedition Migration Tool
References: [{'name': '107900', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107900'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1574'}]
CVE State: PUBLISHED
Explain CVE-2019-1575
Information disclosure in PAN-OS 7.1.23 and earlier, PAN-OS 8.0.18 and earlier, PAN-OS 8.1.8-h4 and earlier, and PAN-OS 9.0.2 and earlier may allow for an authenticated user with read-only privileges to extract the API key of the device and/or the username/password from the XML API (in PAN-OS) and possibly escalate privileges granted to them.
Affected Products: Palo Alto Networks PAN-OS
References: [{'name': '109176', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1575'}]
CVE State: PUBLISHED
Explain CVE-2019-1576
Command injection in PAN-0S 9.0.2 and earlier may allow an authenticated attacker to gain access to a remote shell in PAN-OS, and potentially run with the escalated user’s permissions.
Affected Products: Palo Alto Networks PAN-OS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1576'}]
CVE State: PUBLISHED
Explain CVE-2019-1577
Code injection vulnerability in Palo Alto Networks Traps 5.0.5 and earlier may allow an authenticated attacker to inject arbitrary JavaScript or HTML.
Affected Products: Traps
References: [{'name': '109053', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109053'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1577'}]
CVE State: PUBLISHED
Explain CVE-2019-1578
Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated MineMeld admin to type malicious input in the MineMeld UI could execute arbitrary JavaScript code in the admin’s browser.
Affected Products: MineMeld
References: [{'name': '109056', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109056'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1578'}]
CVE State: PUBLISHED
Explain CVE-2019-1579
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
Affected Products: Palo Alto Networks GlobalProtect Portal/Gateway Interface
References: [{'name': '109310', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109310'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2019-0010'}, {'tags': ['x_refsource_MISC'], 'url': 'https://devco.re/blog/2019/07/17/attacking-ssl-vpn-part-1-PreAuth-RCE-on-Palo-Alto-GlobalProtect-with-Uber-as-case-study/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security.paloaltonetworks.com/CVE-2019-1579'}]
CVE State: PUBLISHED