alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2019-11119 (published 2019-06-13)
Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: raid_web_console_3
CVE-2019-1112 (published 2019-07-15)
An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: office, office_365_proplus
CVE-2019-11120 (published 2019-10-11)
Insufficient path checking in the installer for Intel(R) Active System Console before version 8.0 Build 24 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: 62x_chipset, active_system_console
CVE-2019-11121 (published 2020-11-12)
Improper file permissions in the installer for the Intel(R) Media SDK for Windows before version 2019 R1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: intel, microsoft
Affected products: media_sdk, windows
CVE-2019-11123 (published 2019-06-13)
Insufficient session validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: compute_card_cd1c64gk, compute_card_cd1iv128mk, compute_card_cd1m3128mk, compute_card_cd1p64gk, compute_card_firmware, compute_stick_firmware, compute_stick_stck1a32wfc, compute_stick_stck1a8lfc, compute_stick_stk2m364cc, compute_stick_stk2m3w64cc, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc8i3bex
CVE-2019-11124 (published 2019-06-13)
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: intel
Affected products: compute_card_cd1c64gk, compute_card_cd1iv128mk, compute_card_cd1m3128mk, compute_card_cd1p64gk, compute_card_firmware, compute_stick_firmware, compute_stick_stck1a32wfc, compute_stick_stck1a8lfc, compute_stick_stk2m364cc, compute_stick_stk2m3w64cc, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc8i3bex
CVE-2019-11125 (published 2019-06-13)
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: compute_card_cd1c64gk, compute_card_cd1iv128mk, compute_card_cd1m3128mk, compute_card_cd1p64gk, compute_card_firmware, compute_stick_firmware, compute_stick_stck1a32wfc, compute_stick_stck1a8lfc, compute_stick_stk2m364cc, compute_stick_stk2m3w64cc, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc8i3bex
CVE-2019-11126 (published 2019-06-13)
Pointer corruption in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: intel
Affected products: compute_card_cd1c64gk, compute_card_cd1iv128mk, compute_card_cd1m3128mk, compute_card_cd1p64gk, compute_card_firmware, compute_stick_firmware, compute_stick_stck1a32wfc, compute_stick_stck1a8lfc, compute_stick_stk2m364cc, compute_stick_stk2m3w64cc, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc8i3bex
CVE-2019-11127 (published 2019-06-13)
Buffer overflow in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: intel
Affected products: compute_card_cd1c64gk, compute_card_cd1iv128mk, compute_card_cd1m3128mk, compute_card_cd1p64gk, compute_card_firmware, compute_stick_firmware, compute_stick_stck1a32wfc, compute_stick_stck1a8lfc, compute_stick_stk2m364cc, compute_stick_stk2m3w64cc, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc8i3bex
CVE-2019-11128 (published 2019-06-13)
Insufficient input validation in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: compute_card_cd1c64gk, compute_card_cd1iv128mk, compute_card_cd1m3128mk, compute_card_cd1p64gk, compute_card_firmware, compute_stick_firmware, compute_stick_stck1a32wfc, compute_stick_stck1a8lfc, compute_stick_stk2m364cc, compute_stick_stk2m3w64cc, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc8i3bex
CVE-2019-11129 (published 2019-06-13)
Out of bound read/write in system firmware for Intel(R) NUC Kit may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: intel
Affected products: compute_card_cd1c64gk, compute_card_cd1iv128mk, compute_card_cd1m3128mk, compute_card_cd1p64gk, compute_card_firmware, compute_stick_firmware, compute_stick_stck1a32wfc, compute_stick_stck1a8lfc, compute_stick_stk2m364cc, compute_stick_stk2m3w64cc, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc8i3bex
CVE-2019-1113 (published 2019-07-15)
A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: microsoft
Affected products: .net_framework, visual_studio_2017, windows_10, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019
CVE-2019-11131 (published 2019-12-18)
Logic issue in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: active_management_technology_firmware
CVE-2019-11132 (published 2019-12-18)
Cross site scripting in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow a privileged user to potentially enable escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: intel
Affected products: active_management_technology_firmware
CVE-2019-11133 (published 2019-07-11)
Improper access control in the Intel(R) Processor Diagnostic Tool before version 4.1.2.24 may allow an authenticated user to potentially enable escalation of privilege, information disclosure or denial of service via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: processor_diagnostic_tool
CVE-2019-11135 (published 2019-11-14)
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Affected vendors: canonical, debian, fedoraproject, hp, intel, opensuse, oracle, redhat, slackware
Affected products: apollo_2000, apollo_2000_firmware, apollo_4200, apollo_4200_firmware, celeron_5305u, celeron_5305u_firmware, codeready_linux_builder, codeready_linux_builder_eus, core_i5-10110y, core_i5-10110y_firmware, core_i5-10210u, core_i5-10210u_firmware, core_i5-10210y, core_i5-10210y_firmware, core_i5-10310y, core_i5-10310y_firmware, core_i5-8200y, core_i5-8200y_firmware, core_i5-8210y, core_i5-8210y_firmware, core_i5-8265u, core_i5-8265u_firmware, core_i5-8310y, core_i5-8310y_firmware, core_i5-8365u
CVE-2019-11136 (published 2019-11-14)
Insufficient access control in system firmware for Intel(R) Xeon(R) Scalable Processors, 2nd Generation Intel(R) Xeon(R) Scalable Processors and Intel(R) Xeon(R) Processors D Family may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: hpe, intel
Affected products: apollo_4200_gen10_server, apollo_4200_gen10_server_firmware, apollo_4200_gen9_server, apollo_4200_gen9_server_firmware, atom_c2308, atom_c2308_firmware, atom_c2316, atom_c2316_firmware, atom_c2338, atom_c2338_firmware, atom_c2350, atom_c2350_firmware, atom_c2358, atom_c2358_firmware, atom_c2508, atom_c2508_firmware, atom_c2516, atom_c2516_firmware, atom_c2518, atom_c2518_firmware, atom_c2530, atom_c2530_firmware, atom_c2538, atom_c2538_firmware, atom_c2550
CVE-2019-11137 (published 2019-11-14)
Insufficient input validation in system firmware for Intel(R) Xeon(R) Scalable Processors, Intel(R) Xeon(R) Processors D Family, Intel(R) Xeon(R) Processors E5 v4 Family, Intel(R) Xeon(R) Processors E7 v4 Family and Intel(R) Atom(R) processor C Series may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: hpe, intel
Affected products: apollo_4200_gen10_server, apollo_4200_gen10_server_firmware, apollo_4200_gen9_server, apollo_4200_gen9_server_firmware, atom_c2308, atom_c2308_firmware, atom_c2316, atom_c2316_firmware, atom_c2338, atom_c2338_firmware, atom_c2350, atom_c2350_firmware, atom_c2358, atom_c2358_firmware, atom_c2508, atom_c2508_firmware, atom_c2516, atom_c2516_firmware, atom_c2518, atom_c2518_firmware, atom_c2530, atom_c2530_firmware, atom_c2538, atom_c2538_firmware, atom_c2550
CVE-2019-11139 (published 2019-11-14)
Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: debian, intel, opensuse
Affected products: debian_linux, leap, xeon_3104, xeon_3104_firmware, xeon_3106, xeon_3106_firmware, xeon_4108, xeon_4108_firmware, xeon_4109t, xeon_4109t_firmware, xeon_4110, xeon_4110_firmware, xeon_4112, xeon_4112_firmware, xeon_4114, xeon_4114_firmware, xeon_4114t, xeon_4114t_firmware, xeon_4116, xeon_4116_firmware, xeon_4116t, xeon_4116t_firmware, xeon_5115, xeon_5115_firmware, xeon_5118
CVE-2019-11140 (published 2019-08-19)
Insufficient session validation in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: compute_card_cd1iv128mk, compute_card_firmware, compute_stick_firmware, compute_stick_stk2mv64cc, nuc_kit_firmware, nuc_kit_nuc7i3dnx, nuc_kit_nuc7i5dnx, nuc_kit_nuc7i7dnx
CVE-2019-11143 (published 2019-08-19)
Improper permissions in the software installer for Intel(R) Authenticate before 3.8 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: authenticate
CVE-2019-11145 (published 2019-08-19)
Improper file verification in Intel® Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-275
Affected vendors: intel
Affected products: driver_\&_support_assistant
CVE-2019-11146 (published 2019-08-19)
Improper file verification in Intel® Driver & Support Assistant before 19.7.30.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-275
Affected vendors: intel
Affected products: driver_\&_support_assistant
CVE-2019-11147 (published 2019-12-18)
Insufficient access control in hardware abstraction driver for MEInfo software for Intel(R) CSME before versions 11.8.70, 11.11.70, 11.22.70, 12.0.45, 13.0.0, 14.0.10; TXEInfo software for Intel(R) TXE before versions 3.1.70 and 4.0.20; INTEL-SA-00086 Detection Tool version 1.2.7.0 or before; INTEL-SA-00125 Detection Tool version 1.0.45.0 or before may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: converged_security_management_engine_firmware, intel-sa-00125_detection_tool, sa-00086_detection_tool, trusted_execution_engine_firmware
CVE-2019-11148 (published 2019-08-19)
Improper permissions in the installer for Intel(R) Remote Displays SDK before version 2.0.1 R2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: remote_displays_sdk
CVE-2019-11151 (published 2019-11-14)
Memory corruption issues in Intel(R) WIFI Drivers before version 21.40 may allow a privileged user to potentially enable escalation of privilege, denial of service, and information disclosure via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3165_firmware, dual_band_wireless-ac_3168, dual_band_wireless-ac_3168_firmware, dual_band_wireless-ac_7265, dual_band_wireless-ac_7265_firmware, dual_band_wireless-ac_8260, dual_band_wireless-ac_8260_firmware, dual_band_wireless-ac_8265, dual_band_wireless-ac_8265_firmware, dual_band_wireless-n_7265, dual_band_wireless-n_7265_firmware, wi-fi_6_ax200, wi-fi_6_ax200_firmware, wi-fi_6_ax201, wi-fi_6_ax201_firmware, wireless-ac_9260, wireless-ac_9260_firmware, wireless-ac_9461, wireless-ac_9461_firmware, wireless-ac_9462, wireless-ac_9462_firmware, wireless-ac_9560, wireless-ac_9560_firmware, wireless-n_7265
CVE-2019-11152 (published 2019-11-14)
Memory corruption issues in Intel(R) WIFI Drivers before version 21.40 may allow a privileged user to potentially enable escalation of privilege, denial of service, and information disclosure via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3165_firmware, dual_band_wireless-ac_3168, dual_band_wireless-ac_3168_firmware, dual_band_wireless-ac_7265, dual_band_wireless-ac_7265_firmware, dual_band_wireless-ac_8260, dual_band_wireless-ac_8260_firmware, dual_band_wireless-ac_8265, dual_band_wireless-ac_8265_firmware, dual_band_wireless-n_7265, dual_band_wireless-n_7265_firmware, wi-fi_6_ax200, wi-fi_6_ax200_firmware, wi-fi_6_ax201, wi-fi_6_ax201_firmware, wireless-ac_9260, wireless-ac_9260_firmware, wireless-ac_9461, wireless-ac_9461_firmware, wireless-ac_9462, wireless-ac_9462_firmware, wireless-ac_9560, wireless-ac_9560_firmware, wireless-n_7265
CVE-2019-11153 (published 2019-11-14)
Memory corruption issues in Intel(R) PROSet/Wireless WiFi Software extension DLL before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and a denial of service via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_7265_\(rev_d\), dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, dual_band_wireless-n_7265_\(rev_d\), proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2019-11154 (published 2019-11-14)
Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of service and information disclosure via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_7265_\(rev_d\), dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, dual_band_wireless-n_7265_\(rev_d\), proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2019-11155 (published 2019-11-14)
Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of service and information disclosure via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_7265_\(rev_d\), dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, dual_band_wireless-n_7265_\(rev_d\), proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2019-11156 (published 2019-11-14)
Logic errors in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, denial of service, and information disclosure via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_7265_\(rev_d\), dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, dual_band_wireless-n_7265_\(rev_d\), proset\/wireless_wifi, wi-fi_6_ax200, wi-fi_6_ax201, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2019-11157 (published 2019-12-16)
Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: core_i3-1000g1, core_i3-1000g1_firmware, core_i3-1000g4, core_i3-1000g4_firmware, core_i3-1005g1, core_i3-1005g1_firmware, core_i3-10110u, core_i3-10110u_firmware, core_i3-10110y, core_i3-10110y_firmware, core_i3-6006u, core_i3-6006u_firmware, core_i3-6098p, core_i3-6098p_firmware, core_i3-6100, core_i3-6100_firmware, core_i3-6100e, core_i3-6100e_firmware, core_i3-6100h, core_i3-6100h_firmware, core_i3-6100t, core_i3-6100t_firmware, core_i3-6100te, core_i3-6100te_firmware, core_i3-6100u
CVE-2019-1116 (published 2019-07-15)
An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1094, CVE-2019-1095, CVE-2019-1098, CVE-2019-1099, CVE-2019-1100, CVE-2019-1101.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: microsoft
Affected products: windows_7, windows_server_2008
CVE-2019-11162 (published 2019-08-19)
Insufficient access control in hardware abstraction in SEMA driver for Intel(R) Computing Improvement Program before version 2.4.0.04733 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: computing_improvement_program
CVE-2019-11163 (published 2019-08-19)
Insufficient access control in a hardware abstraction driver for Intel(R) Processor Identification Utility for Windows before version 6.1.0731 may allow an authenticated user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: processor_identification_utility
CVE-2019-11165 (published 2019-12-16)
Improper conditions check in the Linux kernel driver for the Intel(R) FPGA SDK for OpenCL(TM) Pro Edition before version 19.4 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-754
Affected vendors: intel
Affected products: field_programmable_gate_array_software_development_kit_for_opencl
CVE-2019-11166 (published 2019-09-16)
Improper file permissions in the installer for Intel(R) Easy Streaming Wizard before version 2.1.0731 may allow an authenticated user to potentially enable escalation of privilege via local attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: easy_streaming_wizard
CVE-2019-11167 (published 2019-10-11)
Improper file permission in software installer for Intel(R) Smart Connect Technology for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: intel
Affected products: smart_connect_technology
CVE-2019-11168 (published 2019-11-14)
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-1117 (published 2019-07-15)
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1118, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-11170 (published 2019-11-14)
Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11171 (published 2019-11-14)
Heap corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11172 (published 2019-11-14)
Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-125
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11173 (published 2019-11-14)
Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11174 (published 2019-11-14)
Insufficient access control in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11175 (published 2019-11-14)
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11177 (published 2019-11-14)
Unhandled exception in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-755
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11178 (published 2019-11-14)
Stack overflow in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure and/or denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-120
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11179 (published 2019-11-14)
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-1118 (published 2019-07-15)
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1119, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-11180 (published 2019-11-14)
Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11181 (published 2019-11-14)
Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11182 (published 2019-11-14)
Memory corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: baseboard_management_controller_firmware, bbs2600bpb, bbs2600bpbr, bbs2600bpq, bbs2600bpqr, bbs2600bps, bbs2600bpsr, bbs2600stb, bbs2600stbr, bbs2600stq, bbs2600stqr, hns2600bpb, hns2600bpb24, hns2600bpb24r, hns2600bpb24rx, hns2600bpblc, hns2600bpblc24, hns2600bpblc24r, hns2600bpblcr, hns2600bpbr, hns2600bpbrx, hns2600bpq, hns2600bpq24, hns2600bpq24r, hns2600bpqr
CVE-2019-11184 (published 2019-09-16)
A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-362
Affected vendors: intel, netapp
Affected products: 3106, 3106_firmware, 4109t, 4109t_firmware, 4110, 4110_firmware, 4114t, 4114t_firmware, 4116, 4116_firmware, 4116t, 4116t_firmware, 5118, 5118_firmware, 5119t, 5119t_firmware, 5120t, 5120t_firmware, 6126, 6126_firmware, 6126t, 6126t_firmware, 6130, 6130_firmware, 6130t
CVE-2019-11185 (published 2019-06-03)
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: 3cx
Affected products: live_chat
CVE-2019-11187 (published 2019-08-15)
Incorrect Access Control in the LDAP class of GONICUS GOsa through 2019-04-11 allows an attacker to log into any account with a username containing the case-insensitive substring "success" when an arbitrary password is provided.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: debian, gonicus
Affected products: debian_linux, gosa
CVE-2019-11189 (published 2020-02-20)
Authentication Bypass by Spoofing in org.onosproject.acl (access control) and org.onosproject.mobility (host mobility) in ONOS v2.0 and earlier allows attackers to bypass network access control via data plane packet injection. To exploit the vulnerability, an attacker sends a gratuitous ARP reply that causes the host mobility application to remove existing access control flow denial rules in the network. The access control application does not re-install flow deny rules, so the attacker can bypass the intended access control policy.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-290
Affected vendors: opennetworking
Affected products: onos
CVE-2019-1119 (published 2019-07-15)
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1120, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2019
CVE-2019-11190 (published 2019-04-12)
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-362
Affected vendors: linux
Affected products: linux_kernel
CVE-2019-11191 (published 2019-04-12)
The Linux kernel through 5.0.7, when CONFIG_IA32_AOUT is enabled and ia32_aout is loaded, allows local users to bypass ASLR on setuid a.out programs (if any exist) because install_exec_creds() is called too late in load_aout_binary() in fs/binfmt_aout.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat. NOTE: the software maintainer disputes that this is a vulnerability because ASLR for a.out format executables has never been supported
Severity: LOW (CVSS 3.0 vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-362
Affected vendors: linux
Affected products: linux_kernel
CVE-2019-11193 (published 2019-04-30)
The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: directadmin
Affected products: directadmin
CVE-2019-11196 (published 2019-04-12)
An authentication bypass vulnerability in all versions of ValuePLUS Integrated University Management System (IUMS) allows unauthenticated, remote attackers to gain administrator privileges via the Teachers Web Panel (TWP) User ID or Password field. If exploited, the attackers could perform any actions with administrator privileges (e.g., enumerate/delete all the students' personal information or modify various settings).
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: vpcsbd
Affected products: integrated_university_management_system
CVE-2019-11198 (published 2019-08-05)
Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: sitecore
Affected products: cms
CVE-2019-11199 (published 2019-07-29)
Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dolibarr
Affected products: dolibarr_erp\/crm
CVE-2019-1120 (published 2019-07-15)
A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1117, CVE-2019-1118, CVE-2019-1119, CVE-2019-1121, CVE-2019-1122, CVE-2019-1123, CVE-2019-1124, CVE-2019-1127, CVE-2019-1128.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_server_2016, windows_server_2019
CVE-2019-11200 (published 2019-07-29)
Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: dolibarr
Affected products: dolibarr_erp\/crm
CVE-2019-11201 (published 2019-07-29)
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: dolibarr
Affected products: dolibarr_erp\/crm
CVE-2019-11202 (published 2019-07-30)
An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.2.1. When Rancher starts for the first time, it creates a default admin user with a well-known password. After initial setup, the Rancher administrator may choose to delete this default admin user. If Rancher is restarted, the default admin user will be recreated with the well-known default password. An attacker could exploit this by logging in with the default admin credentials. This can be mitigated by deactivating the default admin user rather than completing deleting them.
Severity: CRITICAL (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: suse
Affected products: rancher
CVE-2019-11203 (published 2019-04-24)
The workspace client, openspace client, app development client, and REST API of TIBCO Software Inc.'s TIBCO ActiveMatrix BPM, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM contain cross site scripting (XSS) and cross-site request forgery vulnerabilities. Affected releases are TIBCO Software Inc.'s TIBCO ActiveMatrix BPM: versions up to and including 4.2.0, TIBCO ActiveMatrix BPM Distribution for TIBCO Silver Fabric: versions up to and including 4.2.0, and TIBCO Silver Fabric Enabler for ActiveMatrix BPM: versions up to and including 1.4.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tibco
Affected products: activematrix_business_process_management, silver_fabric_enabler
CVE-2019-11204 (published 2019-05-14)
The web interface component of TIBCO Software Inc.'s TIBCO Spotfire Statistics Services contains a vulnerability that might theoretically allow an authenticated user to access sensitive information needed by the Spotfire Statistics Services server. The sensitive information that might be affected includes database, JMX, LDAP, Windows service account, and user credentials. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Statistics Services: versions up to and including 7.11.1; 10.0.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: tibco
Affected products: spotfire_statistics_services
CVE-2019-11205 (published 2019-05-14)
The web server component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow reflected cross-site scripting (XSS) attacks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: 7.14.0; 7.14.1; 10.0.0; 10.0.1; 10.1.0; 10.2.0, and TIBCO Spotfire Server: 7.14.0; 10.0.0; 10.0.1; 10.1.0; 10.2.0.
Severity: MEDIUM (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tibco
Affected products: spotfire_analytics_platform_for_aws, spotfire_server
CVE-2019-11206 (published 2019-05-14)
The Spotfire library component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace, and TIBCO Spotfire Server contains vulnerabilities that theoretically allow a malicious user to undermine the integrity of comments and bookmarks. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 10.2.0, and TIBCO Spotfire Server: versions up to and including 7.11.2; 7.12.0; 7.13.0; 7.14.0; 10.0.0; 10.0.1; 10.1.0; and 10.2.0.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: tibco
Affected products: spotfire_analytics_platform_for_aws, spotfire_server
CVE-2019-11207 (published 2019-08-13)
The web server component of TIBCO Software Inc.'s TIBCO LogLogic Enterprise Virtual Appliance, and TIBCO LogLogic Log Management Intelligence contains multiple vulnerabilities that theoretically allow persistent and reflected cross-site scripting (XSS) attacks, as well as cross-site request forgery (CSRF) attacks. This issue affects: TIBCO Software Inc. TIBCO LogLogic Enterprise Virtual Appliance version 6.2.1 and prior versions. TIBCO Software Inc. TIBCO LogLogic Log Management Intelligence 6.2.1. TIBCO LogLogic LX825 Appliance 0.0.004, TIBCO LogLogic LX1025 Appliance 0.0.004, TIBCO LogLogic LX4025 Appliance 0.0.004, TIBCO LogLogic MX3025 Appliance 0.0.004, TIBCO LogLogic MX4025 Appliance 0.0.004, TIBCO LogLogic ST1025 Appliance 0.0.004, TIBCO LogLogic ST2025-SAN Appliance 0.0.004, and TIBCO LogLogic ST4025 Appliance 0.0.004 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below. TIBCO LogLogic LX1035 Appliance 0.0.005, TIBCO LogLogic LX1025R1 Appliance 0.0.004, TIBCO LogLogic LX1025R2 Appliance 0.0.004, TIBCO LogLogic LX4025R1 Appliance 0.0.004, TIBCO LogLogic LX4025R2 Appliance 0.0.004, TIBCO LogLogic LX4035 Appliance 0.0.005, TIBCO LogLogic ST2025-SANR1 Appliance 0.0.004, TIBCO LogLogic ST2025-SANR2 Appliance 0.0.004, TIBCO LogLogic ST2035-SAN Appliance 0.0.005, TIBCO LogLogic ST4025R1 Appliance 0.0.004, TIBCO LogLogic ST4025R2 Appliance 0.0.004, and TIBCO LogLogic ST4035 Appliance 0.0.005 using TIBCO LogLogic Log Management Intelligence versions 6.2.1 and below.
Severity: HIGH (CVSS 3.0 vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: tibco
Affected products: loglogic_enterprise_virtual_appliance, loglogic_log_management_intelligence, loglogic_lx1025, loglogic_lx1025_firmware, loglogic_lx1025r1, loglogic_lx1025r1_firmware, loglogic_lx1025r2, loglogic_lx1025r2_firmware, loglogic_lx1035, loglogic_lx1035_firmware, loglogic_lx4025, loglogic_lx4025_firmware, loglogic_lx4025r1, loglogic_lx4025r1_firmware, loglogic_lx4025r2, loglogic_lx4025r2_firmware, loglogic_lx4035, loglogic_lx4035_firmware, loglogic_lx825, loglogic_lx825_firmware, loglogic_mx3025, loglogic_mx3025_firmware, loglogic_mx4025, loglogic_mx4025_firmware, loglogic_st1025