Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-17143 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.091Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-416 Description: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An
e issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9273. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-913/
CVE ID: CVE-2019-17144 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.200Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DWG files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of
The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9274. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-914/
CVE ID: CVE-2019-17145 State: PUBLISHED Published: 2019-10-25T18:14:18 Last Updated: 2024-08-05T01:33:17.267Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Foxit Products: PhantomPDF Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed
The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9276. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-915/
CVE ID: CVE-2019-17146 State: PUBLISHED Published: 2020-01-07T23:05:23 Last Updated: 2024-08-05T01:33:17.110Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DCS-960L Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the SOAPAction request header, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attack
ocess does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8458. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-1031/ - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10142
CVE ID: CVE-2019-17147 State: PUBLISHED Published: 2020-01-07T23:05:23 Last Updated: 2024-08-05T01:33:17.300Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: TL-WR841N Problem Types: CWE-120 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Host request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An att
does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8457. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-992/ - https://www.tp-link.com/us/support/download/tl-wr841n/#Firmware
CVE ID: CVE-2019-17148 State: PUBLISHED Published: 2020-01-07T23:05:24 Last Updated: 2024-08-05T01:33:17.372Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Parallels Products: Desktop Problem Types: CWE-77 Description: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop version 14.1.3 (45485). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. The issue results from the lack of proper validation of a user-supplied string before using it to
he Parallels Service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of root. Was ZDI-CAN-8685. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-1028/
CVE ID: CVE-2019-17149 State: REJECTED Published: 2020-01-15T00:05:14 Last Updated: 2020-01-15T00:05:14 Description: No description available.
CVE ID: CVE-2019-17150 State: REJECTED Published: 2020-01-15T00:05:14 Last Updated: 2020-01-15T00:05:14 Description: No description available.
CVE ID: CVE-2019-17151 State: PUBLISHED Published: 2020-01-07T23:05:24 Last Updated: 2024-08-05T01:33:17.282Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Tencent Products: WeChat Problem Types: CWE-356 Description: This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction is required to exploit this vulnerability in that the target must be within a chat session together with the attacker. The specific flaw exists within the parsing of a users profile. The issue lies in the failure to properly validate a users name. An attacker can leverage this in conjunc
users profile. The issue lies in the failure to properly validate a users name. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9302. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-19-1035/
CVE ID: CVE-2019-17175 State: PUBLISHED Published: 2019-10-04T14:42:17 Last Updated: 2024-08-05T01:33:17.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: joyplus-cms 1.6.0 allows manager/admin_pic.php?rootpath= absolute path traversal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/joyplus/joyplus-cms/issues/443
CVE ID: CVE-2019-17176 State: PUBLISHED Published: 2019-10-11T20:59:57 Last Updated: 2024-08-05T01:33:17.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter). Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/MortalP0ison/5fd584b4c85fa13281fdc918913446fa
CVE ID: CVE-2019-17177 State: PUBLISHED Published: 2019-10-04T16:57:40 Last Updated: 2024-08-05T01:33:17.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: libfreerdp/codec/region.c in FreeRDP through 1.1.x and 2.x through 2.0.0-rc4 has memory leaks because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/issues/5645 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.html - https://security.gentoo.org/glsa/202005-07 - https://us
.opensuse.org/opensuse-security-announce/2019-12/msg00005.html - https://security.gentoo.org/glsa/202005-07 - https://usn.ubuntu.com/4379-1/ - https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a
CVE ID: CVE-2019-17178 State: PUBLISHED Published: 2019-10-04T16:57:19 Last Updated: 2024-08-05T01:33:17.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/FreeRDP/FreeRDP/issues/5645 - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.html - https:/
ty-announce/2019-12/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00005.html - https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a
CVE ID: CVE-2019-17179 State: PUBLISHED Published: 2019-10-04T18:53:10 Last Updated: 2024-08-05T01:33:17.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/pull/2701 - https://github.com/lodestone-security/CVEs/blob/master/CVE-2019-17179/README.md
CVE ID: CVE-2019-17180 State: PUBLISHED Published: 2019-10-04T19:21:02 Last Updated: 2024-08-05T01:33:17.306Z Vendors: n/a Products: n/a Problem Types: n/a Description: Valve Steam Client before 2019-09-12 allows placing or appending partially controlled filesystem content, as demonstrated by file modifications on Windows in the context of NT AUTHORITY\SYSTEM. This could lead to denial of service, elevation of privilege, or unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://amonitoring.ru/article/steam_vuln_3/ - https://habr.com/ru/company/pm/blog/469507/ - https://hackerone.com/reports/682774 - https://store.steampowered.com/news/54236/ - http
om/ru/company/pm/blog/469507/ - https://hackerone.com/reports/682774 - https://store.steampowered.com/news/54236/ - https://hackerone.com/reports/583184
CVE ID: CVE-2019-17181 State: PUBLISHED Published: 2019-10-28T16:27:06 Last Updated: 2024-08-05T01:33:17.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system. Additional Analyst Notes: - CVE Program Container: References: - http://www.leighb.com/intrasrv.htm - https://cxsecurity.com/issue/WLB-2019100164
CVE ID: CVE-2019-17183 State: PUBLISHED Published: 2019-10-04T20:00:23 Last Updated: 2024-08-05T01:33:17.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit Reader before 9.7 allows an Access Violation and crash if insufficient memory exists. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2019-17184 State: PUBLISHED Published: 2019-10-04T22:28:03 Last Updated: 2024-08-05T01:33:17.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xerox AtlaLink B8045/B8055/B8065/B8075/B8090 C8030/C8035/C8045/C8055/C8070 printers with software before 101.00x.089.22600 allow an attacker to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - https://security.business.xerox.com/wp-content/uploads/2019/09/cert_Security_Mini_Bulletin_XRX19V_for_AltaLinkB80xx-C80xx.pdf - https://securitydocs.business.xerox.com/wp-content/uploads/2019/09/cert_Security_Mini_Bulletin_XRX19V_for_AltaLinkB80xx-C80xx-1.pdf
CVE ID: CVE-2019-17185 State: PUBLISHED Published: 2020-03-21T00:13:05 Last Updated: 2024-08-05T01:33:17.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. This mean multiple threads use the same BN_CTX instance concurrently, resulting in crashes when concurrent EAP-pwd handshakes are initiated. This can be abused by an adversary as a Denial-of-Service (DoS) attack. Additional Analyst Notes: - CVE Program Container: References: - https://freeradius.org/security/ - https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20 - http://lists.opensuse.
ius.org/security/ - https://github.com/FreeRADIUS/freeradius-server/releases/tag/release_3_0_20 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00039.html
CVE ID: CVE-2019-17186 State: PUBLISHED Published: 2019-10-08T18:12:47 Last Updated: 2024-08-05T01:33:17.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: /var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/ztz472947849/d62e7b6f4831b55c338ef22432eca06d
CVE ID: CVE-2019-17187 State: PUBLISHED Published: 2019-10-08T14:34:00 Last Updated: 2024-08-05T01:33:17.313Z Vendors: n/a Products: n/a Problem Types: n/a Description: /var/WEB-GUI/cgi-bin/downloadfile.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication Directory Traversal for reading arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/ztz472947849/d62e7b6f4831b55c338ef22432eca06d
CVE ID: CVE-2019-17188 State: PUBLISHED Published: 2019-10-04T21:55:46 Last Updated: 2024-08-05T01:33:17.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs because the code relies on the getimagesize function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fecshop/yii2_fecshop/issues/77
CVE ID: CVE-2019-17189 State: PUBLISHED Published: 2019-10-22T14:37:53 Last Updated: 2024-08-05T01:33:17.333Z Vendors: n/a Products: n/a Problem Types: n/a Description: totemodata 3.0.0_b936 has XSS via a folder name. Additional Analyst Notes: - CVE Program Container: References: - https://www.totemo.com/en/solutions/secure-file-transfer - https://www.compass-security.com/en/research/advisories/ - https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-021_totemodata_Cross-Site_Scripting_XSS.txt
CVE ID: CVE-2019-17190 State: PUBLISHED Published: 2020-01-27T15:23:49 Last Updated: 2024-08-05T01:33:17.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by the AvastBrowserUpdate.exe (which is running as NT AUTHORITY\SYSTEM) when AvastSecureBrowser.exe checks for new updates. When the update check is triggered, the elevated process cleans the ACL of the Update.ini file in %PROGRAMDATA%\Avast Software\Browser\Update\ and sets all privileges to group Everyone. Because any low-privileged user can create, delete, or modify the Update.ini file st
s all privileges to group Everyone. Because any low-privileged user can create, delete, or modify the Update.ini file stored in this location, an attacker with low privileges can create a hard link named Update.ini in this folder, and make it point to a file writable by NT AUTHORITY\SYSTEM. Once AvastBrowserUpdate.exe is triggered by the update check functionality, the DACL is set to a misconfigured value on the crafted Update.ini and, consequently, to the target file that was previously not writable by the low-privileged attacker. Additional Analyst Notes: - CVE Program Container: References: - https://www.avast.com/bug-bounty-credits/en/a-tribute-to-our-security-research-community - http:/
ntainer: References: - https://www.avast.com/bug-bounty-credits/en/a-tribute-to-our-security-research-community - http://seclists.org/fulldisclosure/2020/Mar/25 - http://packetstormsecurity.com/files/156844/Avast-Secure-Browser-76.0.1659.101-Local-Privilege-Escalation.html
CVE ID: CVE-2019-17191 State: PUBLISHED Published: 2019-10-05T01:15:51 Last Updated: 2024-08-05T01:33:17.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interaction, via a connect message. The existence of the call is noticeable to the callee; however, the audio channel may be open before the callee can block eavesdropping. Additional Analyst Notes: - CVE Program Container: References: - https://news.ycombinator.com/item?id=21161432 - https://twitter.com/moxie/status/1180261210341511168 - https://bugs.chromium.org/p/project-zero/issues/detail?
1161432 - https://twitter.com/moxie/status/1180261210341511168 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1943
CVE ID: CVE-2019-17192 State: PUBLISHED Published: 2019-10-05T01:13:31 Last Updated: 2024-08-05T01:33:17.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs Additional Analyst Notes: - CVE Program Container: References: - https://news.ycombinator.com/item?id=211
change occurs Additional Analyst Notes: - CVE Program Container: References: - https://news.ycombinator.com/item?id=21161432 - https://twitter.com/moxie/status/1180226374851710976 - https://bugs.chromium.org/p/project-zero/issues/detail?id=1936
CVE ID: CVE-2019-17195 State: PUBLISHED Published: 2019-10-15T13:42:34 Last Updated: 2024-08-05T01:33:17.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d%40%3Ccommon-dev.hadoop
E - https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d%40%3Ccommon-dev.hadoop.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt - https://connect2id.com/blog/nimbus-jose-jwt-7-9 - https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98%40%3Cdev.avro.apache.org%3E - https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a%40%3Cdev.avro.apache.org%3E - https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb7
5ba27ff6b494d15a3b66efe6a%40%3Cdev.avro.apache.org%3E - https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/se
com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html
CVE ID: CVE-2019-17197 State: PUBLISHED Published: 2019-10-05T18:39:54 Last Updated: 2024-08-05T01:33:17.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patient.inc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/pull/2692 - https://github.com/openemr/openemr/pull/2698/files
CVE ID: CVE-2019-17199 State: PUBLISHED Published: 2019-10-05T19:04:23 Last Updated: 2024-08-05T01:33:17.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regular expression, as demonstrated by the a.jpg\.. substring. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WPO-Foundation/webpagetest/pull/1299
CVE ID: CVE-2019-17201 State: PUBLISHED Published: 2020-01-23T00:00:00 Last Updated: 2024-08-05T01:33:17.158Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AC:L/AV:L/A:N/C:H/I:H/PR:N/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. When a user requests elevation using the AdminByRequest.exe interface, the interface communicates with the underlying service (Audckq32.exe) using a .NET named pipe. If the underlying service responds that a user is permitted access to the elevation feature, the client then reinitiates communica