deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-9837
Published: 2017-04-11
Description: coders/pnm.c in ImageMagick 6.9.0-1 Beta and earlier allows remote attackers to cause a denial of service (crash) via a crafted png file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26682; http://www.openwall.com/lists/oss-security/2016/06/02/13; https://anonscm.debian.org/cgit/collab-maint/imagemagick.git/commit/?h=debian-patches/6.8.9.9-4-for-upstream&id=7a7119c6fe19324ee17b8f756dae60c16e470ab2
CVE: CVE-2015-7893
Published: 2017-04-11
Description: SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://packetstormsecurity.com/files/135643/Samsung-SecEmailUI-Script-Injection.html; http://www.securityfocus.com/bid/77431; https://bugs.chromium.org/p/project-zero/issues/detail?id=494&q=samsung&redir=1
CVE: CVE-2015-8504
Published: 2017-04-11
Description: Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commitdiff%3Bh=4c65fed8bdf96780735dbdb92a8; http://www.debian.org/security/2016/dsa-3469; http://www.debian.org/security/2016/dsa-3470
CVE: CVE-2015-8568
Published: 2017-04-11
Description: Memory leak in QEMU, when built with a VMWARE VMXNET3 paravirtual NIC emulator support, allows local guest users to cause a denial of service (host memory consumption) by trying to activate the vmxnet3 device repeatedly.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: http://www.debian.org/security/2016/dsa-3471; http://www.openwall.com/lists/oss-security/2015/12/15/10; http://www.securityfocus.com/bid/79721
CVE: CVE-2015-8613
Published: 2017-04-11
Description: Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://www.debian.org/security/2016/dsa-3471; http://www.openwall.com/lists/oss-security/2015/12/22/1; http://www.securityfocus.com/bid/79719
CVE: CVE-2015-8666
Published: 2017-04-11
Description: Heap-based buffer overflow in QEMU, when built with the Q35-chipset-based PC system emulator.
CVSS Score: 7.9 (HIGH)
CWE: CWE-787
References: http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=d9a3b33d2c9f996537b7f1d0246dee2d0120cefb; http://www.openwall.com/lists/oss-security/2015/12/24/1; http://www.securityfocus.com/bid/79670
CVE: CVE-2016-2553
Published: 2017-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: none.  Reason: This candidate was withdrawn by its CNA.  Further investigation showed that it was not a security issue.  Notes: none
CVE: CVE-2017-7469
Published: 2017-04-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2017-7466.  Reason:  This candidate is a reservation duplicate of CVE-2017-7466.  Notes: All CVE users should reference CVE-2017-7466 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-7689
Published: 2017-04-11
Description: A Command Injection vulnerability in Schneider Electric homeLYnk Controller exists in all versions before 1.5.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-052-02; http://www.securityfocus.com/bid/97585; https://ics-cert.us-cert.gov/advisories/ICSA-17-019-01A
CVE: CVE-2017-7691
Published: 2017-04-11
Description: A code injection vulnerability exists in SAP TREX / Business Warehouse Accelerator (BWA). The vendor response is SAP Security Note 2419592.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://www.securityfocus.com/bid/97567; https://blogs.sap.com/2017/04/11/sap-security-patch-day-april-2017/; http://www.securityfocus.com/bid/97567
CVE: CVE-2017-7694
Published: 2017-04-11
Description: Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.math1as.com/symphonycms_2.7_exec.txt; http://www.securityfocus.com/bid/97594; https://github.com/symphonycms/symphony-2/commit/e30a18f8f09dca836e141bf126a26e565c9a2bc7
CVE: CVE-2017-7695
Published: 2017-04-11
Description: Unrestricted File Upload exists in BigTree CMS before 4.2.17: if an attacker uploads an 'xxx.php[space]' file, they could bypass a safety check and execute any code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://www.math1as.com/bigtree_upload.txt; https://github.com/bigtreecms/BigTree-CMS/commit/8cf4212ea40e1b843e1aecf4b24681b0964ec04c; https://github.com/bigtreecms/BigTree-CMS/issues/276
CVE: CVE-2017-7697
Published: 2017-04-11
Description: In libsamplerate before 0.1.9, a buffer over-read occurs in the calc_output_single function in src_sinc.c via a crafted audio file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/97587; https://github.com/erikd/libsamplerate/issues/11; https://lists.debian.org/debian-lts-announce/2021/12/msg00010.html
CVE: CVE-2016-7547
Published: 2017-04-12
Description: A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-361
References: http://www.securityfocus.com/bid/97610; https://github.com/rapid7/metasploit-framework/pull/8216/commits/0f07875a2ddb0bfbb4e985ab074e9fc56da1dcf6; http://www.securityfocus.com/bid/97610
CVE: CVE-2016-7552
Published: 2017-04-12
Description: On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://www.securityfocus.com/bid/97599; https://github.com/rapid7/metasploit-framework/pull/8216/commits/0f07875a2ddb0bfbb4e985ab074e9fc56da1dcf6; http://www.securityfocus.com/bid/97599
CVE: CVE-2016-7957
Published: 2017-04-12
Description: In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-btl2cap.c by avoiding use of a seven-byte memcmp for potentially shorter strings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97597; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12825; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=355b56b1c6c545072ac0c1225730b526c6749f0a
CVE: CVE-2016-7958
Published: 2017-04-12
Description: In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/CMakeLists.txt by registering this dissector.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/93463; https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=12945; https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=67597cb2457fb843fa97d3f2c87b82dad6f0de07
CVE: CVE-2017-7588
Published: 2017-04-12
Description: On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attempt. Affected models are: MFC-J6973CDW MFC-J4420DW MFC-8710DW MFC-J4620DW MFC-L8850CDW MFC-J3720 MFC-J6520DW MFC-L2740DW MFC-J5910DW MFC-J6920DW MFC-L2700DW MFC-9130CW MFC-9330CDW MFC-9340CDW MFC-J5620DW MFC-J6720DW MFC-L8600CDW MFC-L9550CDW MFC-L2720DW DCP-L2540DW DCP-L2520DW HL-3140CW HL-3170CDW HL-3180CDW HL-L8350CDW HL-L2380DW ADS-2500W ADS-1000W ADS-1500W.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://cxsecurity.com/blad/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/41863/; https://cxsecurity.com/blad/WLB[PII_REDACTED]
CVE: CVE-2017-0058
Published: 2017-04-12
Description: A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97462; http://www.securitytracker.com/id/1038239; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0058
CVE: CVE-2017-0093
Published: 2017-04-12
Description: A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0201.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97419; http://www.securitytracker.com/id/1038234; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0093
CVE: CVE-2017-0106
Published: 2017-04-12
Description: Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/97413; http://www.securitytracker.com/id/1038227; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0106
CVE: CVE-2017-0155
Published: 2017-04-12
Description: The Graphics component in the kernel in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka "Windows Graphics Elevation of Privilege Vulnerability."
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/97471; http://www.securitytracker.com/id/1038237; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0155
CVE: CVE-2017-0156
Published: 2017-04-12
Description: An elevation of privilege vulnerability exists in Windows 7, Windows 8.1, Windows RT 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 when the Microsoft Graphics Component fails to properly handle objects in memory, aka "Windows Graphics Component Elevation of Privilege Vulnerability."
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/97507; http://www.securitytracker.com/id/1038237; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0156
CVE: CVE-2017-0158
Published: 2017-04-12
Description: An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.1 Windows RT 8.1, and Windows Server 2012 R2 fails to properly sanitize handles in memory, aka "Scripting Engine Memory Corruption Vulnerability."
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/97455; http://www.securitytracker.com/id/1038238; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0158
CVE: CVE-2017-0159
Published: 2017-04-12
Description: A security feature bypass vulnerability exists in Windows 10 1607, Windows Server 2012 R2, and Windows 2016 when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests, aka "ADFS Security Feature Bypass Vulnerability."
CVSS Score: 3.7 (LOW)
References: http://www.securityfocus.com/bid/97449; http://www.securitytracker.com/id/1038243; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0159
CVE: CVE-2017-0160
Published: 2017-04-12
Description: Microsoft .NET Framework 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allows an attacker with access to the local system to execute malicious code, aka ".NET Remote Code Execution Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/97447; http://www.securitytracker.com/id/1038236; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0160
CVE: CVE-2017-0162
Published: 2017-04-12
Description: A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a Windows 10, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Remote Code Execution Vulnerability." This CVE ID is unique from CVE-2017-0163, CVE-2017-0180, and CVE-2017-0181.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97461; http://www.securitytracker.com/id/1038233; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0162
CVE: CVE-2017-0163
Published: 2017-04-12
Description: A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Remote Code Execution Vulnerability." This CVE ID is unique from CVE-2017-0162, CVE-2017-0180, and CVE-2017-0181.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97465; http://www.securitytracker.com/id/1038233; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0163
CVE: CVE-2017-0164
Published: 2017-04-12
Description: A denial of service vulnerability exists in Windows 10 1607 and Windows Server 2016 Active Directory when an authenticated attacker sends malicious search queries, aka "Active Directory Denial of Service Vulnerability."
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97448; http://www.securitytracker.com/id/1038235; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0164
CVE: CVE-2017-0165
Published: 2017-04-12
Description: An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 fails to properly sanitize handles in memory, aka "Windows Elevation of Privilege Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/97467; http://www.securitytracker.com/id/1038239; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0165
CVE: CVE-2017-0166
Published: 2017-04-12
Description: An elevation of privilege vulnerability exists in Windows when LDAP request buffer lengths are improperly calculated. In a remote attack scenario, an attacker could exploit this vulnerability by running a specially crafted application to send malicious traffic to a Domain Controller, aka "LDAP Elevation of Privilege Vulnerability."
CVSS Score: 8.1 (HIGH)
CWE: CWE-131
References: http://www.securityfocus.com/bid/97446; http://www.securitytracker.com/id/1038245; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0166
CVE: CVE-2017-0167
Published: 2017-04-12
Description: An information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system, a.k.a. "Windows Kernel Information Disclosure Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97473; http://www.securitytracker.com/id/1038239; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0167
CVE: CVE-2017-0168
Published: 2017-04-12
Description: An information disclosure vulnerability exists when the Windows Hyper-V Network Switch running on a Windows 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2 host operating system fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-0169.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97418; http://www.securitytracker.com/id/1038232; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0168
CVE: CVE-2017-0169
Published: 2017-04-12
Description: An information disclosure vulnerability exists when Windows Hyper-V running on a Windows 8.1, Windows Server 2012. or Windows Server 2012 R2 host operating system fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-0168.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97459; http://www.securitytracker.com/id/1038232; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0169
CVE: CVE-2017-0178
Published: 2017-04-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V running on Windows 10, Windows 10 1511, Windows 10 1607, Windows 8.1, Windows Server 2012 R2, and Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability." This CVE ID is unique from CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97416; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0178; http://www.securityfocus.com/bid/97416
CVE: CVE-2017-0179
Published: 2017-04-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V running on a Windows 10, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability." This CVE ID is unique from CVE-2017-0178, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97426; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0179; http://www.securityfocus.com/bid/97426
CVE: CVE-2017-0180
Published: 2017-04-12
Description: A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Remote Code Execution Vulnerability." This CVE ID is unique from CVE-2017-0162, CVE-2017-0163, and CVE-2017-0181.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97444; http://www.securitytracker.com/id/1038233; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0180
CVE: CVE-2017-0181
Published: 2017-04-12
Description: A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a Windows 10 or Windows Server 2016 host server fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Remote Code Execution Vulnerability." This CVE ID is unique from CVE-2017-0162, CVE-2017-0163, and CVE-2017-0180.
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97445; http://www.securitytracker.com/id/1038233; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0181
CVE: CVE-2017-0182
Published: 2017-04-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows Server 2008 R2, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability." This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97427; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0182; http://www.securityfocus.com/bid/97427
CVE: CVE-2017-0183
Published: 2017-04-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows Server 2008 R2, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability." This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97428; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0183; http://www.securityfocus.com/bid/97428
CVE: CVE-2017-0184
Published: 2017-04-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V running on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability." This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0185, and CVE-2017-0186.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97435; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0184; http://www.securityfocus.com/bid/97435
CVE: CVE-2017-0185
Published: 2017-04-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability." This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, and CVE-2017-0186.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97437; http://www.securitytracker.com/id/1038230; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0185
CVE: CVE-2017-0186
Published: 2017-04-12
Description: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka "Hyper-V Denial of Service Vulnerability." This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, and CVE-2017-0185.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/97438; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0186; http://www.securityfocus.com/bid/97438
CVE: CVE-2017-0188
Published: 2017-04-12
Description: A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-0189.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/97475; http://www.securitytracker.com/id/1038239; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0188