Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-6587 State: PUBLISHED Published: 2018-03-29T13:00:00Z Last Updated: 2024-09-17T00:46:52.776Z Vendors: CA Technologies Products: CA API Developer Portal Problem Types: CWE-79 Description: CA API Developer Portal 3.5 up to and including 3.5 CR6 has a reflected cross-site scripting vulnerability related to the widgetID variable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040603 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180328-01--security-notice-for-ca-api-developer-portal.html
CVE ID: CVE-2018-6588 State: PUBLISHED Published: 2018-03-29T13:00:00Z Last Updated: 2024-09-16T18:19:39.828Z Vendors: CA Technologies Products: CA API Developer Portal Problem Types: CWE-79 Description: CA API Developer Portal 3.5 up to and including 3.5 CR5 has a reflected cross-site scripting vulnerability related to the apiExplorer. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040603 - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180328-01--security-notice-for-ca-api-developer-portal.html
CVE ID: CVE-2018-6589 State: PUBLISHED Published: 2018-05-01T18:00:00 Last Updated: 2024-08-05T06:10:10.419Z Vendors: CA Technologies Products: CA Spectrum Problem Types: CWE-20 Description: CA Spectrum 10.1 prior to 10.01.02.PTF_10.1.239 and 10.2.x prior to 10.2.3 allows remote attackers to cause a denial of service via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180501-01--security-notice-for-ca-spectrum.html
CVE ID: CVE-2018-6590 State: PUBLISHED Published: 2018-08-03T14:00:00Z Last Updated: 2024-09-16T22:40:46.832Z Vendors: ca technologies Products: CA API Developer Portal Problem Types: CWE-79 Description: CA API Developer Portal 4.x, prior to v4.2.5.3 and v4.2.7.1, has an unspecified reflected cross-site scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180802-01--security-notice-for-ca-api-developer-portal.html - http://www.securitytracker.com/id/1041416
CVE ID: CVE-2018-6591 State: PUBLISHED Published: 2018-02-19T14:00:00 Last Updated: 2024-08-05T06:10:10.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example, users might have an expectation that chatroom bookmarks are private, but the various interacting software components do not necessarily make that happen. Additional Analyst Notes: - CVE Program Container: References: - https://gultsch.de/converse_bookmarks.html
CVE ID: CVE-2018-6592 State: PUBLISHED Published: 2018-02-19T19:00:00 Last Updated: 2024-08-05T06:10:10.381Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unisys Stealth 3.3 Windows endpoints before 3.3.016.1 allow local users to gain access to Stealth-enabled devices by leveraging improper cleanup of memory used for negotiation key storage. Additional Analyst Notes: - CVE Program Container: References: - http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=45
CVE ID: CVE-2018-6593 State: PUBLISHED Published: 2018-02-03T18:00:00 Last Updated: 2024-08-05T06:10:10.350Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by connecting to the filter communication port and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43973/ - https://github.com/SouhailHammou/Exploits/blob/master/CVE-2018-6593/Malwarefox_privescl_0.c
CVE ID: CVE-2018-6594 State: PUBLISHED Published: 2018-02-03T03:00:00 Last Updated: 2024-08-05T06:10:10.652Z Vendors: n/a Products: n/a Problem Types: n/a Description: lib/Crypto/PublicKey/ElGamal.py in PyCrypto through 2.6.1 generates weak ElGamal key parameters, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for PyCrypto's ElGamal implementation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TElgamal/attack-on-pycrypto-elgamal - https://usn.ubuntu.com/3616-1/ - https://github.com
ferences: - https://github.com/TElgamal/attack-on-pycrypto-elgamal - https://usn.ubuntu.com/3616-1/ - https://github.com/dlitz/pycrypto/issues/253 - https://lists.debian.org/debian-lts-announce/2018/02/msg00018.html - https://usn.ubuntu.com/3616-2/ - https://security.gentoo.org/glsa/202007-62
CVE ID: CVE-2018-6596 State: PUBLISHED Published: 2018-02-03T21:00:00 Last Updated: 2024-08-05T06:10:10.753Z Vendors: n/a Products: n/a Problem Types: n/a Description: webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4107 - https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691b - https://github.com/anymail/django-anymail/releases/tag/v1.3 - https://github.com/anymail/django-anymail/commit/db5
91b - https://github.com/anymail/django-anymail/releases/tag/v1.3 - https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5 - https://bugs.debian.org/889450 - https://github.com/anymail/django-anymail/releases/tag/v1.2.1
CVE ID: CVE-2018-6597 State: PUBLISHED Published: 2018-08-29T19:00:00 Last Updated: 2024-08-05T06:10:10.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Alcatel A30 device with a build fingerprint of TCL/5046G/MICKEY6US:7.0/NRD90M/J63:user/release-keys contains a hidden privilege escalation capability to achieve command execution as the root user. They have made modifications that allow a user with physical access to the device to obtain a root shell via ADB. Modifying the read-only properties by an app as the system user creates a UNIX domain socket named factory_test that will execute commands as the root user by processes that have privilege to access it (as per the SEL
d factory_test that will execute commands as the root user by processes that have privilege to access it (as per the SELinux rules that the vendor controls). Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-6598 State: PUBLISHED Published: 2018-08-29T19:00:00 Last Updated: 2024-08-05T06:10:10.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices. Any app co-located on the device can send an intent to factory reset the device programmatically because of com.android.server.MasterClearReceiver. This does not require any user interaction and does not require any permission to perform. A factory reset will remove all user data from the device. This will result in the loss of any data that the user has not backed up or synced externally. This capability to perform a fa
ill result in the loss of any data that the user has not backed up or synced externally. This capability to perform a factory reset is not directly available to third-party apps (those that the user installs themselves), although this capability is present in an unprotected component of the Android OS. This vulnerability is not present in Google's Android Open Source Project (AOSP) code. Therefore, it was introduced by Orbic or another entity in the supply chain. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-6599 State: PUBLISHED Published: 2018-08-29T19:00:00 Last Updated: 2024-08-05T06:10:10.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing attackers to obtain sensitive information (such as text-message content) by reading a copy of the Android log on the SD card. The system-wide Android logs are not directly available to third-party apps since they tend to contain sensitive data. Third-party apps can read from the log but only the log messages that the app itself has written. Certain apps can leak data to the Android log due to not sanitizing log
e log messages that the app itself has written. Certain apps can leak data to the Android log due to not sanitizing log messages, which is in an insecure programming practice. Pre-installed system apps and apps that are signed with the framework key can read from the system-wide Android log. We found a pre-installed app on the Orbic Wonder that when started via an Intent will write the Android log to the SD card, also known as external storage, via com.ckt.mmitest.MmiMainActivity. Any app that requests the READ_EXTERNAL_STORAGE permission can read from the SD card. Therefore, a local app on the device can quickly start a specific component in the pre-installed system app to have the Android
e, a local app on the device can quickly start a specific component in the pre-installed system app to have the Android log written to the SD card. Therefore, any app co-located on the device with the READ_EXTERNAL_STORAGE permission can obtain the data contained within the Android log and continually monitor it and mine the log for relevant data. In addition, the default messaging app (com.android.mms) writes the body of sent and received text messages to the Android log, as well as the recipient phone number for sent text messages and the sending phone number for received text messages. In addition, any call data contains phone numbers for sent and received calls. Additional Analyst Notes:
text messages. In addition, any call data contains phone numbers for sent and received calls. Additional Analyst Notes: - CVE Program Container: References: - https://www.kryptowire.com/portal/android-firmware-defcon-2018/
CVE ID: CVE-2018-6603 State: PUBLISHED Published: 2018-02-07T05:00:00 Last Updated: 2024-08-05T06:10:10.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS, HTTP Response Splitting, and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie. Additional Analyst Notes: - CVE Program Container: References: - http://dfdrconsulting.com/cve-2018-6603-promise-technology-webpam-pro-e-http-response-header-injection-xss/
CVE ID: CVE-2018-6604 State: PUBLISHED Published: 2018-02-05T21:00:00 Last Updated: 2024-08-05T06:10:10.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43975/
CVE ID: CVE-2018-6605 State: PUBLISHED Published: 2018-02-05T21:00:00 Last Updated: 2024-08-05T06:10:10.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43974/
CVE ID: CVE-2018-6606 State: PUBLISHED Published: 2018-02-04T01:00:00 Last Updated: 2024-08-05T06:10:10.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MalwareFox AntiMalware 2.74.0.150. Improper access control in zam32.sys and zam64.sys allows a non-privileged process to register itself with the driver by sending IOCTL 0x80002010 and then using IOCTL 0x8000204C to \\.\ZemanaAntiMalware to elevate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SouhailHammou/Exploits/blob/master/CVE-2018-6606/Malwarefox_privescl_1.c - https://www.exploit-db.com/exploits/43987/
CVE ID: CVE-2018-6608 State: PUBLISHED Published: 2018-03-28T21:00:00 Last Updated: 2024-08-05T06:10:10.657Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VoidSec/WebRTC-Leak - https://voidsec.com/vpn-leak/ - https://news.ycombinator.com/item?id=16699270 - https://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5O0BIdbJiIAWUnkoAF_v_0ug/edit?usp=sharing - https://www.bleepin
tps://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5O0BIdbJiIAWUnkoAF_v_0ug/edit?usp=sharing - https://www.bleepingcomputer.com/news/security/many-vpn-providers-leak-customers-ip-address-via-webrtc-bug/
CVE ID: CVE-2018-6609 State: PUBLISHED Published: 2018-02-05T22:00:00 Last Updated: 2024-08-05T06:10:10.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a statuslist (or prioritylist) edit action. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43978
CVE ID: CVE-2018-6610 State: PUBLISHED Published: 2018-02-05T22:00:00 Last Updated: 2024-08-05T06:10:10.656Z Vendors: n/a Products: n/a Problem Types: n/a Description: Information Leakage exists in the jLike 1.0 component for Joomla! via a task=getUserByCommentId request. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43977
CVE ID: CVE-2018-6611 State: PUBLISHED Published: 2018-02-04T12:00:00 Last Updated: 2024-08-05T06:10:10.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: soundlib/Load_stp.cpp in OpenMPT through 1.27.04.00, and libopenmpt before 0.3.6, has an out-of-bounds read via a malformed STP file. Additional Analyst Notes: - CVE Program Container: References: - https://lib.openmpt.org/libopenmpt/2018/02/03/security-update-0.3.6/ - https://github.com/OpenMPT/openmpt/commit/b60b322cf9f0ffa624018f1bb9783edf0dc908c3
CVE ID: CVE-2018-6612 State: PUBLISHED Published: 2018-02-04T15:00:00Z Last Updated: 2024-09-17T03:17:57.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer underflow bug in the process_EXIF function of the exif.c file of jhead 3.00 raises a heap-based buffer over-read when processing a malicious JPEG file, which may allow a remote attacker to cause a denial-of-service attack or unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889272 - https://launchpad.net/ubuntu/+source/jhead/1:3.00-6
CVE ID: CVE-2018-6616 State: PUBLISHED Published: 2018-02-04T22:00:00 Last Updated: 2024-08-05T06:10:10.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/12/msg00013.html - https://www.debian.org/security/2019/dsa-4405 - https://usn.ubuntu.com/4109-1/ - https://www.oracle.com/security-alerts/cpujul2020.html - https://github.com/uclouvain/openjpeg/issues/1059
CVE ID: CVE-2018-6617 State: PUBLISHED Published: 2018-05-11T21:00:00 Last Updated: 2024-08-05T06:10:10.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Hosting Control Panel (EHCP) v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-UNVERIFIED-PASSWORD-CHANGE.txt - http://packetstormsecurity.com/files/147558/Easy-Hosting-Control-Panel-0.37.12.b-Unverified-Password-Change.html
CVE ID: CVE-2018-6618 State: PUBLISHED Published: 2018-05-11T21:00:00 Last Updated: 2024-08-05T06:10:10.664Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Hosting Control Panel (EHCP) v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-CLEARTEXT-PASSWORD-STORAGE.txt - http://packetstormsecurity.com/files/147557/Easy-Hosting-Control-Panel-0.37.12.b-Clear-Text-Password-Storage.html
CVE ID: CVE-2018-6619 State: PUBLISHED Published: 2018-05-11T21:00:00 Last Updated: 2024-08-05T06:10:10.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: Easy Hosting Control Panel (EHCP) v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a salt. Additional Analyst Notes: - CVE Program Container: References: - http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-INSECURE-CRYPTO.txt - http://packetstormsecurity.com/files/147556/Easy-Hosting-Control-Panel-0.37.12.b-Insecure-Cryptography.html
CVE ID: CVE-2018-6620 State: REJECTED Published: 2018-02-05T04:00:00 Last Updated: 2018-07-10T15:57:01 Description: No description available.
CVE ID: CVE-2018-6621 State: PUBLISHED Published: 2018-02-05T04:00:00 Last Updated: 2024-08-05T06:10:10.722Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decode_frame function in libavcodec/utvideodec.c in FFmpeg through 3.2 allows remote attackers to cause a denial of service (out of array read) via a crafted AVI file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102950 - https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/118e1b0b3370dd1c0da442901b486689efd1654b - https://www.debian.org/security/2018/dsa-4249 - https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html - https://github.com/FFmpeg/FFmpeg/commit/22aa3
249 - https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html - https://github.com/FFmpeg/FFmpeg/commit/22aa37c0fedf14531783189a197542a055959b6c
CVE ID: CVE-2018-6622 State: PUBLISHED Published: 2018-08-17T18:00:00 Last Updated: 2024-08-05T06:10:10.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2.0 specification. An abnormal case is not handled properly by this firmware while S3 sleep and can clear TPM 2.0. It allows local users to overwrite static PCRs of TPM and neutralize the security features of it, such as seal/unseal and remote attestation. Additional Analyst Notes: - CVE Program Container: References: - http://ww
, such as seal/unseal and remote attestation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105203 - https://www.usenix.org/conference/usenixsecurity18/presentation/han
CVE ID: CVE-2018-6623 State: PUBLISHED Published: 2018-03-12T21:00:00 Last Updated: 2024-08-05T06:10:10.742Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Hola 1.79.859. An unprivileged user could modify or overwrite the executable with arbitrary code, which would be executed the next time the service is started. Depending on the user that the service runs as, this could result in privilege escalation. The issue exists because of the SERVICE_ALL_ACCESS access right for the hola_svc and hola_updater services. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/23
CVE ID: CVE-2018-6624 State: PUBLISHED Published: 2018-02-05T18:00:00 Last Updated: 2024-08-05T06:10:10.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html
CVE ID: CVE-2018-6625 State: PUBLISHED Published: 2018-02-05T18:00:00Z Last Updated: 2024-09-17T03:37:39.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/WatchDog_AntiMalware_POC/tree/master/0x80002010
CVE ID: CVE-2018-6626 State: PUBLISHED Published: 2018-02-05T18:00:00Z Last Updated: 2024-09-16T20:42:19.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000035. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000035
CVE ID: CVE-2018-6627 State: PUBLISHED Published: 2018-02-05T18:00:00Z Last Updated: 2024-09-16T22:34:54.097Z Vendors: n/a Products: n/a Problem Types: n/a Description: In WatchDog Anti-Malware 2.74.186.150, the driver file (ZAMGUARD32.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/WatchDog_AntiMalware_POC/tree/master/0x80002054
CVE ID: CVE-2018-6628 State: PUBLISHED Published: 2018-02-05T18:00:00Z Last Updated: 2024-09-16T20:07:41.733Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x8000010c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/8000010c
CVE ID: CVE-2018-6629 State: PUBLISHED Published: 2018-02-05T18:00:00Z Last Updated: 2024-09-17T01:46:08.329Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Micropoint proactive defense software 2.0.20266.0146, the driver file (mp110005.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80000118. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZhiyuanWang-Chengdu-Qihoo360/Micropoint_POC/tree/master/mp110005/80000118