alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2020-8618 (published 2020-06-17)
An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to clients.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: canonical, isc, netapp, opensuse
Affected products: bind, leap, steelstore_cloud_integrated_storage, ubuntu_linux
CVE-2020-8619 (published 2020-06-17)
In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: canonical, debian, fedoraproject, isc, netapp, opensuse
Affected products: bind, debian_linux, fedora, leap, steelstore_cloud_integrated_storage, ubuntu_linux
CVE-2020-8620 (published 2020-08-21)
In BIND 9.15.6 -> 9.16.5, 9.17.0 -> 9.17.3, An attacker who can establish a TCP connection with the server and send data on that connection can exploit this to trigger the assertion failure, causing the server to exit.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: canonical, isc, netapp, opensuse
Affected products: bind, leap, steelstore_cloud_integrated_storage, ubuntu_linux
CVE-2020-8621 (published 2020-08-21)
In BIND 9.14.0 -> 9.16.5, 9.17.0 -> 9.17.3, If a server is configured with both QNAME minimization and 'forward first' then an attacker who can send queries to it may be able to trigger the condition that will cause the server to crash. Servers that 'forward only' are not affected.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: canonical, isc, netapp, opensuse, synology
Affected products: bind, dns_server, leap, steelstore_cloud_integrated_storage, ubuntu_linux
CVE-2020-8622 (published 2020-08-21)
In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: canonical, debian, fedoraproject, isc, netapp, opensuse, oracle, synology
Affected products: bind, communications_diameter_signaling_router, debian_linux, dns_server, fedora, leap, steelstore_cloud_integrated_storage, ubuntu_linux
CVE-2020-8623 (published 2020-08-21)
In BIND 9.10.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.10.5-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker that can reach a vulnerable system with a specially crafted query packet can trigger a crash. To be vulnerable, the system must: * be running BIND that was built with "--enable-native-pkcs11" * be signing one or more zones with an RSA key * be able to receive queries from a possible attacker
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: canonical, debian, fedoraproject, isc, netapp, opensuse, synology
Affected products: bind, debian_linux, dns_server, fedora, leap, steelstore_cloud_integrated_storage, ubuntu_linux
CVE-2020-8624 (published 2020-08-21)
In BIND 9.9.12 -> 9.9.13, 9.10.7 -> 9.10.8, 9.11.3 -> 9.11.21, 9.12.1 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.12-S1 -> 9.9.13-S1, 9.11.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker who has been granted privileges to change a specific subset of the zone's content could abuse these unintended additional privileges to update other contents of the zone.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-269
Affected vendors: canonical, debian, fedoraproject, isc, netapp, opensuse
Affected products: bind, debian_linux, fedora, leap, steelstore_cloud_integrated_storage, ubuntu_linux
CVE-2020-8625 (published 2021-02-17)
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: debian, fedoraproject, isc, netapp, siemens
Affected products: 500f, 500f_firmware, a250, a250_firmware, bind, cloud_backup, debian_linux, fedora, sinec_infrastructure_network_services
CVE-2020-8631 (published 2020-02-05)
cloud-init through 19.4 relies on Mersenne Twister for a random password, which makes it easier for attackers to predict passwords, because rand_str in cloudinit/util.py calls the random.choice function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-330
Affected vendors: canonical, debian, opensuse
Affected products: cloud-init, debian_linux, leap
CVE-2020-8632 (published 2020-02-05)
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-521
Affected vendors: canonical, debian, opensuse
Affected products: cloud-init, debian_linux, leap
CVE-2020-8633 (published 2020-02-18)
An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-281
Affected vendors: synacor
Affected products: zimbra_collaboration_suite
CVE-2020-8634 (published 2020-03-07)
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: wftpserver
Affected products: wing_ftp_server
CVE-2020-8635 (published 2020-03-07)
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: wftpserver
Affected products: wing_ftp_server
CVE-2020-8636 (published 2020-02-06)
An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: opservices
Affected products: opmon
CVE-2020-8637 (published 2020-04-03)
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in dragdroptreenodes.php via the node_id parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: testlink
Affected products: testlink
CVE-2020-8638 (published 2020-04-03)
A SQL injection vulnerability in TestLink 1.9.20 allows attackers to execute arbitrary SQL commands in planUrgency.php via the urgency parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: testlink
Affected products: testlink
CVE-2020-8639 (published 2020-04-03)
An unrestricted file upload vulnerability in keywordsImport.php in TestLink 1.9.20 allows remote attackers to execute arbitrary code by uploading a file with an executable extension. This allows an authenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to a publicly accessible directory of the application.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: testlink
Affected products: testlink
CVE-2020-8641 (published 2020-02-05)
Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: lotus_core_cms_project
Affected products: lotus_core_cms
CVE-2020-8644 (published 2020-02-05)
PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: playsms
Affected products: playsms
Added to CISA KEV catalog: 2021-11-03
KEV required action: Apply updates per vendor instructions.
CVE-2020-8645 (published 2020-02-07)
An issue was discovered in Simplejobscript.com SJS through 1.66. There is an unauthenticated SQL injection via the job applications search function. The vulnerable parameter is job_id. The function is getJobApplicationsByJobId(). The file is _lib/class.JobApplication.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: simplejobscript
Affected products: simplejobscript
CVE-2020-8647 (published 2020-02-06)
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vc_do_resize function in drivers/tty/vt/vt.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Weakness: CWE-416
Affected vendors: debian, linux, opensuse
Affected products: debian_linux, leap, linux_kernel
CVE-2020-8648 (published 2020-02-06)
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the n_tty_receive_buf_common function in drivers/tty/n_tty.c.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-416
Affected vendors: broadcom, canonical, debian, linux, netapp, opensuse
Affected products: active_iq_unified_manager, brocade_fabric_operating_system_firmware, cloud_backup, debian_linux, hci_baseboard_management_controller, leap, linux_kernel, solidfire_baseboard_management_controller, ubuntu_linux
CVE-2020-8649 (published 2020-02-06)
There is a use-after-free vulnerability in the Linux kernel through 5.5.2 in the vgacon_invert_region function in drivers/video/console/vgacon.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-416
Affected vendors: debian, linux, opensuse
Affected products: debian_linux, leap, linux_kernel
CVE-2020-8654 (published 2020-02-07)
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: eyesofnetwork
Affected products: eyesofnetwork
CVE-2020-8655 (published 2020-02-07)
An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: eyesofnetwork
Affected products: eyesofnetwork
Added to CISA KEV catalog: 2021-11-03
KEV required action: Apply updates per vendor instructions.
CVE-2020-8656 (published 2020-02-07)
An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: eyesofnetwork
Affected products: eyesofnetwork
CVE-2020-8657 (published 2020-02-06)
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: eyesofnetwork
Affected products: eyesofnetwork
Added to CISA KEV catalog: 2021-11-03
KEV required action: Apply updates per vendor instructions.
CVE-2020-8658 (published 2020-02-06)
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: bestwebsoft
Affected products: htaccess
CVE-2020-8659 (published 2020-03-04)
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: cncf, debian, redhat
Affected products: debian_linux, envoy, openshift_service_mesh
CVE-2020-8660 (published 2020-03-04)
CNCF Envoy through 1.13.0 TLS inspector bypass. TLS inspector could have been bypassed (not recognized as a TLS client) by a client using only TLS 1.3. Because TLS extensions (SNI, ALPN) were not inspected, those connections might have been matched to a wrong filter chain, possibly bypassing some security restrictions in the process.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-345
Affected vendors: envoyproxy
Affected products: envoy
CVE-2020-8661 (published 2020-03-04)
CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: cncf, redhat
Affected products: envoy, openshift_service_mesh
CVE-2020-8663 (published 2020-07-01)
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: envoyproxy
Affected products: envoy
CVE-2020-8664 (published 2020-03-04)
CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many resources together with the combined validation context could lead to the “static” part of the validation context to be not applied, even though it was visible in the active config dump.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-287
Affected vendors: cncf
Affected products: envoy
CVE-2020-8669 (published 2020-11-12)
Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: intel
Affected products: data_center_manager
CVE-2020-8670 (published 2021-06-09)
Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: intel, netapp, siemens
Affected products: aff_bios, bios, cloud_backup, core_i3-l13g4, core_i5-l16g7, core_i7-10510u, core_i7-10510y, core_i7-1060g7, core_i7-1060ng7, core_i7-10610u, core_i7-1065g7, core_i7-1068ng7, core_i7-10700, core_i7-10700e, core_i7-10700f, core_i7-10700k, core_i7-10700kf, core_i7-10700t, core_i7-10700te, core_i7-10710u, core_i7-10750h, core_i7-10810u, core_i7-10850h, core_i7-10870h, core_i7-10875h
CVE-2020-8671 (published 2020-10-05)
Insufficient control flow management in BIOS firmware 8th, 9th Generation Intel(R) Core(TM) Processors and Intel(R) Celeron(R) Processor 4000 Series may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: bios, celeron_4205u, celeron_4305u, celeron_4305ue, core_i3_8100, core_i3_8100f, core_i3_8100t, core_i3_8300, core_i3_8300t, core_i3_8350k, core_i3_9100, core_i3_9100f, core_i3_9100t, core_i3_9300, core_i3_9300t, core_i3_9320, core_i3_9350k, core_i3_9350kf, core_i5_8400, core_i5_8400t, core_i5_8500, core_i5_8500t, core_i5_8600, core_i5_8600k, core_i5_8600t
CVE-2020-8672 (published 2021-02-02)
Out of bound read in BIOS firmware for 8th, 9th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 Series Processors may allow an unauthenticated user to potentially enable elevation of privilege or denial of service via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: intel
Affected products: bios, celeron_4205u, celeron_4305u, celeron_4305ue, core_i3_8100, core_i3_8100f, core_i3_8100t, core_i3_8300, core_i3_8300t, core_i3_8350k, core_i3_9100, core_i3_9100f, core_i3_9100t, core_i3_9300, core_i3_9300t, core_i3_9320, core_i3_9350k, core_i3_9350kf, core_i5_8400, core_i5_8400t, core_i5_8500, core_i5_8500t, core_i5_8600, core_i5_8600k, core_i5_8600t
CVE-2020-8674 (published 2020-06-15)
Out-of-bounds read in DHCPv6 subsystem in Intel(R) AMT and Intel(R)ISM versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64 and 14.0.33 may allow an unauthenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-125
Affected vendors: intel
Affected products: active_management_technology_firmware, service_manager
CVE-2020-8675 (published 2020-06-15)
Insufficient control flow management in firmware build and signing tool for Intel(R) Innovation Engine before version 1.0.859 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: innovation_engine, innovation_engine_firmware
CVE-2020-8676 (published 2020-11-12)
Improper access control in the Intel(R) Visual Compute Accelerator 2, all versions, may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: visual_compute_accelerator_2, visual_compute_accelerator_2_firmware
CVE-2020-8677 (published 2020-11-12)
Improper access control in the Intel(R) Visual Compute Accelerator 2, all versions, may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: visual_compute_accelerator_2, visual_compute_accelerator_2_firmware
CVE-2020-8678 (published 2021-02-17)
Improper access control for Intel(R) Graphics Drivers before version 15.45.33.5164 and 27.20.100.8280 may allow an authenticated user to potentially enable an escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: graphics_drivers
CVE-2020-8679 (published 2020-08-13)
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: graphics_drivers
CVE-2020-8680 (published 2020-08-13)
Race condition in some Intel(R) Graphics Drivers before version 15.40.45.5126 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: intel
Affected products: graphics_drivers
CVE-2020-8681 (published 2020-08-13)
Out of bounds write in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: graphics_drivers
CVE-2020-8682 (published 2020-08-13)
Out of bounds read in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: intel
Affected products: graphics_drivers
CVE-2020-8683 (published 2020-08-13)
Improper buffer restrictions in system driver for some Intel(R) Graphics Drivers before version 15.33.50.5129 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: graphics_drivers
CVE-2020-8684 (published 2020-08-13)
Improper access control in firmware for Intel(R) PAC with Arria(R) 10 GX FPGA before Intel Acceleration Stack version 1.2.1 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: acceleration_stack, programmable_acceleration_card_with_arria_10_gx_fpga
CVE-2020-8685 (published 2020-08-13)
Improper authentication in subsystem for Intel (R) LED Manager for NUC before version 1.2.3 may allow privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: led_manager_for_nuc
CVE-2020-8687 (published 2020-08-13)
Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: rste_software_raid
CVE-2020-8688 (published 2020-08-13)
Improper input validation in the Intel(R) RAID Web Console 3 for Windows* may allow an unauthenticated user to potentially enable denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: raid_web_console_3
CVE-2020-8689 (published 2020-08-13)
Improper buffer restrictions in the Intel(R) Wireless for Open Source before version 1.5 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: inet_wireless_daemon
CVE-2020-8690 (published 2020-11-12)
Protection mechanism failure in Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: v710-at2, v710-at2_firmware, x710-at2, x710-at2_firmware, x710-bm2, x710-bm2_firmware, x710-tm4, x710-tm4_firmware, xl710-bm1, xl710-bm1_firmware, xl710-bm2, xl710-bm2_firmware, xxv710-am1, xxv710-am1_firmware, xxv710-am2, xxv710-am2_firmware
CVE-2020-8691 (published 2020-11-12)
A logic issue in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: v710-at2, v710-at2_firmware, x710-at2, x710-at2_firmware, x710-bm2, x710-bm2_firmware, x710-tm4, x710-tm4_firmware, xl710-bm1, xl710-bm1_firmware, xl710-bm2, xl710-bm2_firmware, xxv710-am1, xxv710-am1_firmware, xxv710-am2, xxv710-am2_firmware
CVE-2020-8692 (published 2020-11-12)
Insufficient access control in the firmware of the Intel(R) Ethernet 700 Series Controllers before version 7.3 may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: v710-at2, v710-at2_firmware, x710-at2, x710-at2_firmware, x710-bm2, x710-bm2_firmware, x710-tm4, x710-tm4_firmware, xl710-bm1, xl710-bm1_firmware, xl710-bm2, xl710-bm2_firmware, xxv710-am1, xxv710-am1_firmware, xxv710-am2, xxv710-am2_firmware
CVE-2020-8693 (published 2020-11-12)
Improper buffer restrictions in the firmware of the Intel(R) Ethernet 700 Series Controllers may allow a privileged user to potentially enable escalation of privilege and/or denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: v710-at2, v710-at2_firmware, x710-at2, x710-at2_firmware, x710-bm2, x710-bm2_firmware, x710-tm4, x710-tm4_firmware, xl710-bm1, xl710-bm1_firmware, xl710-bm2, xl710-bm2_firmware, xxv710-am1, xxv710-am1_firmware, xxv710-am2, xxv710-am2_firmware
CVE-2020-8694 (published 2020-11-12)
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: celeron_3855u, celeron_3855u_firmware, celeron_3865u, celeron_3865u_firmware, celeron_3955u, celeron_3955u_firmware, celeron_3965u, celeron_3965u_firmware, celeron_3965y, celeron_3965y_firmware, celeron_g3900, celeron_g3900_firmware, celeron_g3900e, celeron_g3900e_firmware, celeron_g3900t, celeron_g3900t_firmware, celeron_g3900te, celeron_g3900te_firmware, celeron_g3902e, celeron_g3902e_firmware, celeron_g3920, celeron_g3920_firmware, celeron_g3920t, celeron_g3920t_firmware, celeron_g3930e
CVE-2020-8695 (published 2020-11-12)
Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-203
Affected vendors: debian, fedoraproject, intel
Affected products: celeron_3855u, celeron_3855u_firmware, celeron_3865u, celeron_3865u_firmware, celeron_3955u, celeron_3955u_firmware, celeron_3965u, celeron_3965u_firmware, celeron_3965y, celeron_3965y_firmware, celeron_g3900, celeron_g3900_firmware, celeron_g3900e, celeron_g3900e_firmware, celeron_g3900t, celeron_g3900t_firmware, celeron_g3900te, celeron_g3900te_firmware, celeron_g3902e, celeron_g3902e_firmware, celeron_g3920, celeron_g3920_firmware, celeron_g3920t, celeron_g3920t_firmware, celeron_g3930e
CVE-2020-8696 (published 2020-11-12)
Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-212
Affected vendors: debian, fedoraproject, intel, netapp
Affected products: celeron_3855u, celeron_3865u, celeron_3955u, celeron_3965u, celeron_3965y, celeron_5305u, celeron_g3900, celeron_g3900t, celeron_g3900te, celeron_g3902e, celeron_g3920, celeron_g3920t, celeron_g3930e, celeron_g3930te, celeron_g3940, celeron_g4900, celeron_g4900t, celeron_g4920, celeron_g5205u, celeron_g5305u, clustered_data_ontap, core_4205u, core_5405u, core_8269u, core_i3-10100te
CVE-2020-8698 (published 2020-11-12)
Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-668
Affected vendors: debian, fedoraproject, intel, netapp, siemens
Affected products: clustered_data_ontap, core_i3-1000g1, core_i3-1000g4, core_i3-1005g1, core_i3-1110g4, core_i3-1115g4, core_i3-1120g4, core_i3-1125g4, core_i5-1030g4, core_i5-1030g7, core_i5-1035g1, core_i5-1035g4, core_i5-1035g7, core_i5-1130g7, core_i5-1135g7, core_i7-1060g7, core_i7-1065g7, core_i7-1160g7, core_i7-1165g7, core_i7-1185g7, debian_linux, fedora, hci_compute_node, hci_compute_node_bios, hci_storage_node
CVE-2020-8700 (published 2021-06-09)
Improper input validation in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel, netapp
Affected products: aff_bios, bios, cloud_backup, core_i3-l13g4, core_i5-l16g7, core_i7-10510u, core_i7-10510y, core_i7-1060g7, core_i7-1060ng7, core_i7-10610u, core_i7-1065g7, core_i7-1068ng7, core_i7-10700, core_i7-10700e, core_i7-10700f, core_i7-10700k, core_i7-10700kf, core_i7-10700t, core_i7-10700te, core_i7-10710u, core_i7-10750h, core_i7-10810u, core_i7-10850h, core_i7-10870h, core_i7-10875h
CVE-2020-8701 (published 2021-02-17)
Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: solid-state_drive_toolbox
CVE-2020-8702 (published 2021-06-09)
Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: processor_diagnostic_tool
CVE-2020-8703 (published 2021-06-09)
Improper buffer restrictions in a subsystem in the Intel(R) CSME versions before 11.8.86, 11.12.86, 11.22.86, 12.0.81, 13.0.47, 13.30.17, 14.1.53, 14.5.32 and 15.0.22 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: intel, netapp, siemens
Affected products: b150, b250, b360, b365, b460, c242, c246, c420, c621, c621a, c622, c624, c625, c626, c627, c627a, c628, c629, c629a, celeron_4205u, celeron_4305u, celeron_4305ue, celeron_6305, celeron_6305e, cloud_backup
CVE-2020-8704 (published 2021-06-09)
Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: intel, siemens
Affected products: local_manageability_service, simatic_field_pg_m5, simatic_field_pg_m5_firmware, simatic_field_pg_m6, simatic_field_pg_m6_firmware, simatic_ipc427e, simatic_ipc427e_firmware, simatic_ipc477e, simatic_ipc477e_firmware, simatic_ipc477e_pro, simatic_ipc477e_pro_firmware, simatic_ipc527g, simatic_ipc527g_firmware, simatic_ipc547g, simatic_ipc547g_firmware, simatic_ipc627e, simatic_ipc627e_firmware, simatic_ipc647e, simatic_ipc647e_firmware, simatic_ipc677e, simatic_ipc677e_firmware, simatic_ipc847e, simatic_ipc847e_firmware, simatic_itp1000, simatic_itp1000_firmware
CVE-2020-8705 (published 2020-11-12)
Insecure default initialization of resource in Intel(R) Boot Guard in Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE versions before 3.1.80 and 4.0.30, Intel(R) SPS versions before E5_04.01.04.400, E3_04.01.04.200, SoC-X_04.00.04.200 and SoC-A_04.00.04.300 may allow an unauthenticated user to potentially enable escalation of privileges via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1188
Affected vendors: intel
Affected products: converged_security_and_manageability_engine, server_platform_services, trusted_execution_technology
CVE-2020-8706 (published 2020-08-13)
Buffer overflow in a daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8707 (published 2020-08-13)
Buffer overflow in daemon for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8708 (published 2020-08-13)
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8709 (published 2020-08-13)
Improper authentication in socket services for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8710 (published 2020-08-13)
Buffer overflow in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8711 (published 2020-08-13)
Improper access control in the bootloader for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8712 (published 2020-08-13)
Buffer overflow in a verification process for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.45 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8713 (published 2020-08-13)
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8714 (published 2020-08-13)
Improper authentication for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8715 (published 2020-08-13)
Invalid pointer for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an unauthenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-763
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8716 (published 2020-08-13)
Improper access control for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr
CVE-2020-8717 (published 2020-08-13)
Improper input validation in a subsystem for some Intel Server Boards, Server Systems and Compute Modules before version 1.59 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: compute_module_hns2600bp_firmware, compute_module_hns2600bpb, compute_module_hns2600bpb24, compute_module_hns2600bpb24r, compute_module_hns2600bpblc, compute_module_hns2600bpblc24, compute_module_hns2600bpblc24r, compute_module_hns2600bpblcr, compute_module_hns2600bpbr, compute_module_hns2600bpq, compute_module_hns2600bpq24, compute_module_hns2600bpq24r, compute_module_hns2600bpqr, compute_module_hns2600bps, compute_module_hns2600bps24, compute_module_hns2600bps24r, compute_module_hns2600bpsr, compute_module_hns2600kp, compute_module_hns2600kp_firmware, compute_module_hns2600kpf, compute_module_hns2600kpfr, compute_module_hns2600kpr, compute_module_hns2600tp, compute_module_hns2600tp24r, compute_module_hns2600tp24sr