alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2020-12266 (published 2020-04-27)
An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed externally without any authentication. All the pages follow the naming convention live_(string).shtml. Among the information disclosed is: interface status logs, IP address of the device, MAC address of the device, model and current firmware version, location, all running processes, all interfaces and their statuses, all current DHCP leases and the associated hostnames, all other wireless networks in range of the router, memory statistics, and components of the configuration of the device such as enabled features. Affected devices: Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-306
Affected vendors: wavlink
Affected products: jetstream_ac3000, jetstream_ac3000_firmware, jetstream_erac3000, jetstream_erac3000_firmware, wl-wn530hg4, wl-wn530hg4_firmware, wl-wn575a3, wl-wn575a3_firmware, wl-wn579g3, wl-wn579g3_firmware, wn530h4, wn530h4_firmware, wn531a6, wn531a6_firmware, wn531g3, wn531g3_firmware, wn533a8, wn533a8_firmware, wn535g3, wn535g3_firmware, wn551k1, wn551k1_firmware, wn578a2, wn578a2_firmware, wn579g3
CVE-2020-12267 (published 2020-04-27)
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: qt
Affected products: qt
CVE-2020-12268 (published 2020-04-27)
jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: artifex, debian, opensuse
Affected products: debian_linux, jbig2dec, leap
CVE-2020-1227 (published 2020-09-11)
<p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p>
<p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p>
<p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p>
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: microsoft
Affected products: sharepoint_enterprise_server, sharepoint_foundation, sharepoint_server
CVE-2020-12270 (published 2020-04-27)
React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it was a false alert if contact-history comparison fails (i.e., an F0 is not actually part of the contact history obtained from the device of this recipient, or this recipient is not actually part of the contact history obtained from the device of an F0)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-330
Affected vendors: bluezone
Affected products: bluezone
CVE-2020-12271 (published 2020-04-27)
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sophos
Affected products: sfos, xg_firewall
Added to CISA KEV catalog: 2021-11-03
KEV required action: Apply updates per vendor instructions.
CVE-2020-12272 (published 2020-04-27)
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-290
Affected vendors: fedoraproject, trusteddomain
Affected products: fedora, opendmarc
CVE-2020-12273 (published 2020-04-27)
In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-311
Affected vendors: testlink
Affected products: testlink
CVE-2020-12274 (published 2020-04-27)
In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback_url parameter causes a security risk because it depends on client input and is not constrained to lib/cfields/cfieldsView.php at the web site associated with the session.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: testlink
Affected products: testlink
CVE-2020-12275 (published 2020-04-29)
GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: gitlab
Affected products: gitlab
CVE-2020-12276 (published 2020-04-29)
GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: gitlab
Affected products: gitlab
CVE-2020-12277 (published 2020-04-29)
GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-276
Affected vendors: gitlab
Affected products: gitlab
CVE-2020-12278 (published 2020-04-27)
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-706
Affected vendors: debian, libgit2
Affected products: debian_linux, libgit2
CVE-2020-12279 (published 2020-04-27)
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-706
Affected vendors: debian, libgit2
Affected products: debian_linux, libgit2
CVE-2020-1228 (published 2020-09-11)
<p>A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited this vulnerability could cause the DNS service to become nonresponsive.</p>
<p>To exploit the vulnerability, an authenticated attacker could send malicious DNS queries to a target, resulting in a denial of service.</p>
<p>The update addresses the vulnerability by correcting how Windows DNS processes queries.</p>
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12280 (published 2020-09-24)
iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: gogogate
Affected products: ismartgate_pro, ismartgate_pro_firmware
CVE-2020-12281 (published 2020-09-24)
iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: gogogate
Affected products: ismartgate_pro, ismartgate_pro_firmware
CVE-2020-12282 (published 2020-09-24)
iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. (This can be combined with reflected XSS.)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: gogogate
Affected products: ismartgate_pro, ismartgate_pro_firmware
CVE-2020-12283 (published 2020-04-30)
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: sourcegraph
Affected products: sourcegraph
CVE-2020-12284 (published 2020-04-28)
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: canonical, debian, ffmpeg
Affected products: debian_linux, ffmpeg, ubuntu_linux
CVE-2020-12286 (published 2020-04-28)
In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: octopus
Affected products: octopus_deploy
CVE-2020-12287 (published 2020-08-13)
Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: distribution_of_openvino_toolkit
CVE-2020-12288 (published 2021-06-09)
Protection mechanism failure in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12289 (published 2021-06-09)
Out-of-bounds write in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-1229 (published 2020-06-09)
A security feature bypass vulnerability exists in Microsoft Outlook when Office fails to enforce security settings configured on a system, aka 'Microsoft Outlook Security Feature Bypass Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
Affected vendors: microsoft
Affected products: 365_apps, office, word
CVE-2020-12290 (published 2021-06-09)
Improper access control in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12291 (published 2021-06-09)
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12292 (published 2021-06-09)
Improper conditions check in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12293 (published 2021-06-09)
Improper control of a resource through its lifetime in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12294 (published 2021-06-09)
Insufficient control flow management in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12295 (published 2021-06-09)
Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12296 (published 2021-06-09)
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: intel
Affected products: dsl5320_thunderbolt_2, dsl5320_thunderbolt_2_firmware, dsl5520_thunderbolt_2, dsl5520_thunderbolt_2_firmware, dsl6340_thunderbolt_3, dsl6340_thunderbolt_3_firmware, dsl6540_thunderbolt_3, dsl6540_thunderbolt_3_firmware, jhl6240_thunderbolt_3, jhl6240_thunderbolt_3_firmware, jhl6340_thunderbolt_3, jhl6340_thunderbolt_3_firmware, jhl6540_thunderbolt_3, jhl6540_thunderbolt_3_firmware, jhl7040_thunderbolt_3_retimer, jhl7040_thunderbolt_3_retimer_firmware, jhl7340_thunderbolt_3, jhl7340_thunderbolt_3_firmware, jhl7440_thunderbolt_3, jhl7440_thunderbolt_3_firmware, jhl7540_thunderbolt_3, jhl7540_thunderbolt_3_firmware, jhl8010r_usb_retimer, jhl8010r_usb_retimer_firmware, jhl8040r_thunderbolt_4_retimer
CVE-2020-12297 (published 2020-11-12)
Improper access control in Installer for Intel(R) CSME Driver for Windows versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: converged_security_and_manageability_engine, trusted_execution_technology
CVE-2020-12299 (published 2020-08-13)
Improper input validation in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: s2600bpbr, s2600bpbr_firmware, s2600bpqr, s2600bpqr_firmware, s2600bpsr, s2600bpsr_firmware, s2600stbr, s2600stbr_firmware, s2600stqr, s2600stqr_firmware, s2600wf0r, s2600wf0r_firmware, s2600wfqr, s2600wfqr_firmware, s2600wftr, s2600wftr_firmware
CVE-2020-1230 (published 2020-06-09)
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213, CVE-2020-1214, CVE-2020-1215, CVE-2020-1216, CVE-2020-1260.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: internet_explorer, windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12300 (published 2020-08-13)
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-824
Affected vendors: intel
Affected products: s2600cw2, s2600cw2_firmware, s2600cw2r, s2600cw2r_firmware, s2600cw2s, s2600cw2s_firmware, s2600cw2sr, s2600cw2sr_firmware, s2600cwt, s2600cwt_firmware, s2600cwtr, s2600cwtr_firmware, s2600cwts, s2600cwts_firmware, s2600cwtsr, s2600cwtsr_firmware, s2600kp, s2600kp_firmware, s2600kpf, s2600kpf_firmware, s2600kpfr, s2600kpfr_firmware, s2600kpr, s2600kpr_firmware, s2600kptr
CVE-2020-12301 (published 2020-08-13)
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-665
Affected vendors: intel
Affected products: s2600bpbr, s2600bpbr_firmware, s2600bpqr, s2600bpqr_firmware, s2600bpsr, s2600bpsr_firmware, s2600stbr, s2600stbr_firmware, s2600stqr, s2600stqr_firmware, s2600wf0r, s2600wf0r_firmware, s2600wfqr, s2600wfqr_firmware, s2600wftr, s2600wftr_firmware
CVE-2020-12302 (published 2020-10-05)
Improper permissions in the Intel(R) Driver & Support Assistant before version 20.7.26.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: driver_\&_support_assistant
CVE-2020-12303 (published 2020-11-12)
Use after free in DAL subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: intel
Affected products: converged_security_and_manageability_engine, trusted_execution_technology
CVE-2020-12304 (published 2020-11-12)
Improper access control in Installer for Intel(R) DAL SDK before version 2.1 for Windows may allow an authenticated user to potentially enable escalation of privileges via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel, microsoft
Affected products: dynamic_application_loader_software_developement_kit, windows
CVE-2020-12306 (published 2020-11-12)
Incorrect default permissions in the Intel(R) RealSense(TM) D400 Series Dynamic Calibration Tool before version 2.11, may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel, microsoft
Affected products: realsense_d400_series_dynamic_calibration_tool, windows
CVE-2020-12307 (published 2020-11-12)
Improper permissions in some Intel(R) High Definition Audio drivers before version 9.21.00.4561 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: high_definition_audio_driver
CVE-2020-12308 (published 2020-11-12)
Improper access control for the Intel(R) Computing Improvement Program before version 2.4.5982 may allow an unprivileged user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: computing_improvement_program
CVE-2020-12309 (published 2020-11-12)
Insufficiently protected credentialsin subsystem in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: intel
Affected products: optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, ssd_660p, ssd_660p_firmware, ssd_760p, ssd_760p_firmware, ssd_dc_p4101, ssd_dc_p4101_firmware, ssd_dc_p4510, ssd_dc_p4510_firmware, ssd_dc_p4610, ssd_dc_p4610_firmware, ssd_dc_p4800x, ssd_dc_p4800x_firmware, ssd_dc_p4801x, ssd_dc_p4801x_firmware, ssd_e_5100s, ssd_e_5100s_firmware, ssd_e_6100p, ssd_e_6100p_firmware, ssd_pro_5400s, ssd_pro_5400s_firmware, ssd_pro_5450s
CVE-2020-1231 (published 2020-06-09)
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1233, CVE-2020-1235, CVE-2020-1265, CVE-2020-1282, CVE-2020-1304, CVE-2020-1306, CVE-2020-1334.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2020-12310 (published 2020-11-12)
Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, ssd_660p, ssd_660p_firmware, ssd_760p, ssd_760p_firmware, ssd_dc_p4101, ssd_dc_p4101_firmware, ssd_dc_p4510, ssd_dc_p4510_firmware, ssd_dc_p4610, ssd_dc_p4610_firmware, ssd_dc_p4800x, ssd_dc_p4800x_firmware, ssd_dc_p4801x, ssd_dc_p4801x_firmware, ssd_e_5100s, ssd_e_5100s_firmware, ssd_e_6100p, ssd_e_6100p_firmware, ssd_pro_5400s, ssd_pro_5400s_firmware, ssd_pro_5450s
CVE-2020-12311 (published 2020-11-12)
Insufficient control flow managementin firmware in some Intel(R) Client SSDs and some Intel(R) Data Center SSDs may allow an unauthenticated user to potentially enable information disclosure via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: optane_ssd_900p, optane_ssd_900p_firmware, optane_ssd_905p, optane_ssd_905p_firmware, ssd_660p, ssd_660p_firmware, ssd_760p, ssd_760p_firmware, ssd_dc_p4101, ssd_dc_p4101_firmware, ssd_dc_p4510, ssd_dc_p4510_firmware, ssd_dc_p4610, ssd_dc_p4610_firmware, ssd_dc_p4800x, ssd_dc_p4800x_firmware, ssd_dc_p4801x, ssd_dc_p4801x_firmware, ssd_e_5100s, ssd_e_5100s_firmware, ssd_e_6100p, ssd_e_6100p_firmware, ssd_pro_5400s, ssd_pro_5400s_firmware, ssd_pro_5450s
CVE-2020-12312 (published 2020-11-12)
Improper buffer restrictions in the Intel(R) Stratix(R) 10 FPGA firmware provided with the Intel(R) Quartus(R) Prime Pro software before version 20.2 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: quartus_prime_pro, stratix_10_fpga, stratix_10_fpga_firmware
CVE-2020-12313 (published 2020-11-13)
Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2020-12314 (published 2020-11-12)
Improper input validation in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2020-12315 (published 2020-11-12)
Path traversal in the Intel(R) EMA before version 1.3.3 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: intel
Affected products: endpoint_management_assistant
CVE-2020-12316 (published 2020-11-12)
Insufficiently protected credentials in the Intel(R) EMA before version 1.3.3 may allow an authorized user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: intel
Affected products: endpoint_management_assistant
CVE-2020-12317 (published 2020-11-12)
Improper buffer restriction in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2020-12318 (published 2020-11-12)
Protection mechanism failure in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2020-12319 (published 2020-11-12)
Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2020-1232 (published 2020-06-09)
An information disclosure vulnerability exists when Media Foundation improperly handles objects in memory, aka 'Media Foundation Information Disclosure Vulnerability'.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-12320 (published 2020-11-12)
Uncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: scs_add-on_for_microsoft_sccm
CVE-2020-12321 (published 2020-11-12)
Improper buffer restriction in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3165_firmware, dual_band_wireless-ac_3168, dual_band_wireless-ac_3168_firmware, dual_band_wireless-ac_8260, dual_band_wireless-ac_8260_firmware, dual_band_wireless-ac_8265, dual_band_wireless-ac_8265_firmware, wi-fi_6_ax200, wi-fi_6_ax200_firmware, wi-fi_6_ax201, wi-fi_6_ax201_firmware, wireless-ac_9260, wireless-ac_9260_firmware, wireless-ac_9461, wireless-ac_9461_firmware, wireless-ac_9462, wireless-ac_9462_firmware, wireless-ac_9560, wireless-ac_9560_firmware, wireless_7265_\(rev_d\), wireless_7265_\(rev_d\)_firmware
CVE-2020-12322 (published 2020-11-12)
Improper input validation in some Intel(R) Wireless Bluetooth(R) products before version 21.110 may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3165_firmware, dual_band_wireless-ac_3168, dual_band_wireless-ac_3168_firmware, dual_band_wireless-ac_8260, dual_band_wireless-ac_8260_firmware, dual_band_wireless-ac_8265, dual_band_wireless-ac_8265_firmware, wi-fi_6_ax200, wi-fi_6_ax200_firmware, wi-fi_6_ax201, wi-fi_6_ax201_firmware, wireless-ac_9260, wireless-ac_9260_firmware, wireless-ac_9461, wireless-ac_9461_firmware, wireless-ac_9462, wireless-ac_9462_firmware, wireless-ac_9560, wireless-ac_9560_firmware, wireless_7265_\(rev_d\), wireless_7265_\(rev_d\)_firmware
CVE-2020-12323 (published 2020-11-12)
Improper input validation in the Intel(R) ADAS IE before version ADAS_IE_1.0.766 may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: adas_ie
CVE-2020-12324 (published 2020-11-12)
Protection mechanism failure in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: thunderbolt_dch_driver
CVE-2020-12325 (published 2020-11-12)
Improper buffer restrictions in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: thunderbolt_dch_driver
CVE-2020-12326 (published 2020-11-12)
Improper initialization in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-665
Affected vendors: intel
Affected products: thunderbolt_dch_driver
CVE-2020-12327 (published 2020-11-12)
Insecure default variable initialization in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow a privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-1188
Affected vendors: intel
Affected products: thunderbolt_dch_driver
CVE-2020-12328 (published 2020-11-12)
Protection mechanism failure in some Intel(R) Thunderbolt(TM) DCH drivers for Windows* before version 72 may allow a privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: thunderbolt_dch_driver
CVE-2020-12329 (published 2020-11-12)
Uncontrolled search path in the Intel(R) VTune(TM) Profiler before version 2020 Update 1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: vtune_profiler
CVE-2020-1233 (published 2020-06-09)
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1231, CVE-2020-1235, CVE-2020-1265, CVE-2020-1282, CVE-2020-1304, CVE-2020-1306, CVE-2020-1334.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-12330 (published 2020-11-12)
Improper permissions in the installer for the Intel(R) Falcon 8+ UAS AscTec Thermal Viewer, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: intel
Affected products: falcon_8\+_uas_asctec_thermal_viewer, falcon_8\+_uas_asctec_thermal_viewer_firmware
CVE-2020-12331 (published 2020-11-12)
Improper access controls in Intel Unite(R) Cloud Service client before version 4.2.12212 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: unite_cloud_service_client
CVE-2020-12332 (published 2020-11-12)
Improper permissions in the installer for the Intel(R) HID Event Filter Driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: intel
Affected products: hid_event_filter_driver
CVE-2020-12333 (published 2020-11-12)
Insufficiently protected credentials in the Intel(R) QAT for Linux before version 1.7.l.4.10.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: intel
Affected products: quickassist_technology
CVE-2020-12334 (published 2020-11-12)
Improper permissions in the installer for the Intel(R) Advisor tools before version 2020 Update 2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: intel
Affected products: advisor_tools
CVE-2020-12335 (published 2020-11-12)
Improper permissions in the installer for the Intel(R) Processor Identification Utility before version 6.4.0603 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: intel
Affected products: processor_identification_utility
CVE-2020-12336 (published 2020-11-12)
Insecure default variable initialization in firmware for some Intel(R) NUCs may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1188
Affected vendors: intel
Affected products: nuc_8_mainstream-g_kit_nuc8i5inh, nuc_8_mainstream-g_kit_nuc8i5inh_firmware, nuc_8_mainstream-g_kit_nuc8i7inh, nuc_8_mainstream-g_kit_nuc8i7inh_firmware, nuc_8_mainstream-g_mini_pc_nuc8i5inh, nuc_8_mainstream-g_mini_pc_nuc8i5inh_firmware, nuc_8_mainstream-g_mini_pc_nuc8i7inh, nuc_8_mainstream-g_mini_pc_nuc8i7inh_firmware, nuc_8_pro_board_nuc8i3pnb, nuc_8_pro_board_nuc8i3pnb_firmware, nuc_8_pro_kit_nuc8i3pnh, nuc_8_pro_kit_nuc8i3pnh_firmware, nuc_8_pro_kit_nuc8i3pnk, nuc_8_pro_kit_nuc8i3pnk_firmware, nuc_8_pro_mini_pc_nuc8i3pnk, nuc_8_pro_mini_pc_nuc8i3pnk_firmware, nuc_8_rugged_kit_nuc8cchkr, nuc_8_rugged_kit_nuc8cchkr_firmware, nuc_9_pro_kit_nuc9v7qnx, nuc_9_pro_kit_nuc9v7qnx_firmware, nuc_9_pro_kit_nuc9vxqnx, nuc_9_pro_kit_nuc9vxqnx_firmware, nuc_board_h27002-400, nuc_board_h27002-400_firmware, nuc_board_h27002-401
CVE-2020-12337 (published 2020-11-12)
Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: nuc_8_mainstream-g_kit_nuc8i5inh, nuc_8_mainstream-g_kit_nuc8i5inh_firmware, nuc_8_mainstream-g_kit_nuc8i7inh, nuc_8_mainstream-g_kit_nuc8i7inh_firmware, nuc_8_mainstream-g_mini_pc_nuc8i5inh, nuc_8_mainstream-g_mini_pc_nuc8i5inh_firmware, nuc_8_mainstream-g_mini_pc_nuc8i7inh, nuc_8_mainstream-g_mini_pc_nuc8i7inh_firmware, nuc_8_pro_board_nuc8i3pnb, nuc_8_pro_board_nuc8i3pnb_firmware, nuc_8_pro_kit_nuc8i3pnh, nuc_8_pro_kit_nuc8i3pnh_firmware, nuc_8_pro_kit_nuc8i3pnk, nuc_8_pro_kit_nuc8i3pnk_firmware, nuc_8_pro_mini_pc_nuc8i3pnk, nuc_8_pro_mini_pc_nuc8i3pnk_firmware, nuc_8_rugged_kit_nuc8cchkr, nuc_8_rugged_kit_nuc8cchkr_firmware, nuc_9_pro_kit_nuc9v7qnx, nuc_9_pro_kit_nuc9v7qnx_firmware, nuc_9_pro_kit_nuc9vxqnx, nuc_9_pro_kit_nuc9vxqnx_firmware, nuc_board_h27002-400, nuc_board_h27002-400_firmware, nuc_board_h27002-401
CVE-2020-12338 (published 2020-11-13)
Insufficient control flow management in the Open WebRTC Toolkit before version 4.3.1 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: open_webrtc_toolkit
CVE-2020-12339 (published 2021-02-17)
Insufficient control flow management in the API for the Intel(R) Collaboration Suite for WebRTC before version 4.3.1 may allow an authenticated user to potentially enable escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: collaboration_suite
CVE-2020-1234 (published 2020-06-09)
An elevation of privilege vulnerability exists when Windows Error Reporting improperly handles objects in memory.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-12345 (published 2020-11-12)
Improper permissions in the installer for the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-281
Affected vendors: intel
Affected products: data_center_manager
CVE-2020-12346 (published 2020-11-12)
Improper permissions in the installer for the Intel(R) Battery Life Diagnostic Tool before version 1.0.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: intel
Affected products: battery_life_diagnostic_tool
CVE-2020-12347 (published 2020-11-12)
Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: data_center_manager
CVE-2020-12349 (published 2020-11-12)
Improper input validation in the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: intel
Affected products: data_center_manager
CVE-2020-1235 (published 2020-06-09)
An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1231, CVE-2020-1233, CVE-2020-1265, CVE-2020-1282, CVE-2020-1304, CVE-2020-1306, CVE-2020-1334.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2020-12350 (published 2020-11-12)
Improper access control in the Intel(R) XTU before version 6.5.1.360 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: extreme_tuning_utility