deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-11070
Published: 2018-09-11
Description: RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel vulnerability during PKCS #1 unpadding operations, also known as a Bleichenbacher attack. A remote attacker may be able to recover a RSA key.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: http://www.securitytracker.com/id/1041614; http://www.securitytracker.com/id/1041615; https://seclists.org/fulldisclosure/2018/Sep/7
CVE: CVE-2018-11078
Published: 2018-09-11
Description: Dell EMC VPlex GeoSynchrony, versions prior to 6.1, contains an Insecure File Permissions vulnerability. A remote authenticated malicious user could read from VPN configuration files on and potentially author a MITM attack on the VPN traffic.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-732
References: http://www.securitytracker.com/id/1041613; https://seclists.org/fulldisclosure/2018/Sep/10; http://www.securitytracker.com/id/1041613
CVE: CVE-2018-15898
Published: 2018-09-11
Description: The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate, which might allow man-in-the-middle attackers to obtain interaction data.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://packetstormsecurity.com/files/149267/Subsonic-Music-Streamer-4.4-For-Android-Improper-Certificate-Validation.html; http://seclists.org/fulldisclosure/2018/Sep/6; http://packetstormsecurity.com/files/149267/Subsonic-Music-Streamer-4.4-For-Android-Improper-Certificate-Validation.html
CVE: CVE-2018-16946
Published: 2018-09-12
Description: LG LNB*, LND*, LNU*, and LNV* smart network camera devices have broken access control. Attackers are able to download /updownload/t.report (aka Log & Report) files and download backup files (via download.php) without authenticating. These backup files contain user credentials and configuration information for the camera device. An attacker is able to discover the backup filename via reading the system logs or report data, or just by brute-forcing the backup filename pattern. It may be possible to authenticate to the admin account with the admin password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://github.com/EgeBalci/LG-Smart-IP-Device-Backup-Download; https://www.exploit-db.com/exploits/45394/; https://github.com/EgeBalci/LG-Smart-IP-Device-Backup-Download
CVE: CVE-2018-16947
Published: 2018-09-12
Description: An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://openafs.org/pages/security/OPENAFS-SA-2018-001.txt; https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html; https://www.debian.org/security/2018/dsa-4302
CVE: CVE-2018-16948
Published: 2018-09-12
Description: An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several RPC server routines did not fully initialize their output variables before returning, leaking memory contents from both the stack and the heap. Because the OpenAFS cache manager functions as an Rx server for the AFSCB service, clients are also susceptible to information leakage. For example, RXAFSCB_TellMeAboutYourself leaks kernel memory and KAM_ListEntry leaks kaserver memory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://openafs.org/pages/security/OPENAFS-SA-2018-002.txt; https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html; https://www.debian.org/security/2018/dsa-4302
CVE: CVE-2018-16949
Published: 2018-09-12
Description: An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. Several data types used as RPC input variables were implemented as unbounded array types, limited only by the inherent 32-bit length field to 4 GB. An unauthenticated attacker could send, or claim to send, large input values and consume server resources waiting for those inputs, denying service to other valid connections.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: http://openafs.org/pages/security/OPENAFS-SA-2018-003.txt; http://www.securityfocus.com/bid/106375; https://lists.debian.org/debian-lts-announce/2018/09/msg00024.html
CVE: CVE-2018-16951
Published: 2018-09-12
Description: xunfeng 0.2.0 allows command execution via CSRF because masscan.py mishandles backquote characters, a related issue to CVE-2018-16832.
CVSS Score: 8.0 (HIGH)
CWE: CWE-352
References: https://github.com/ysrc/xunfeng/issues/176; https://github.com/ysrc/xunfeng/issues/176
CVE: CVE-2018-16950
Published: 2018-09-12
Description: Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remote attackers to cause a denial of service (connectivity loss) via a series of packets with random MAC addresses, as demonstrated by macof.
CVSS Score: 6.5 (MEDIUM)
References: https://twitter.com/cyberarchconsul/status/[PII_REDACTED]26169857; https://twitter.com/cyberarchconsul/status/[PII_REDACTED]26169857
CVE: CVE-2018-13799
Published: 2018-09-12
Description: A vulnerability has been identified in SIMATIC WinCC OA V3.14 and prior (All versions < V3.14-P021). Improper access control to a data point of the affected product could allow an unauthenticated remote user to escalate its privileges in the context of SIMATIC WinCC OA V3.14. This vulnerability could be exploited by an attacker with network access to port 5678/TCP of the SIMATIC WinCC OA V3.14 server. Successful exploitation requires no user privileges and no user interaction. This vulnerability could allow an attacker to compromise integrity and availability of the SIMATIC WinCC OA system. At the time of advisory publication no public exploitation of this vulnerability was known.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-269
References: http://www.securityfocus.com/bid/105332; https://cert-portal.siemens.com/productcert/pdf/ssa-346256.pdf; http://www.securityfocus.com/bid/105332
CVE: CVE-2018-13806
Published: 2018-09-12
Description: A vulnerability has been identified in SIEMENS TD Keypad Designer (All versions). A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Designer which could allow an attacker to execute code with the permission of the user running TD Designer. The attacker must have write access to the directory containing the TD project file in order to exploit the vulnerability. A legitimate user with higher privileges than the attacker must open the TD project in order for this vulnerability to be exploited. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://cert-portal.siemens.com/productcert/pdf/ssa-198330.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-198330.pdf
CVE: CVE-2018-13807
Published: 2018-09-12
Description: A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versions). The web interface on port 443/tcp could allow an attacker to cause a Denial-of-Service condition by sending specially crafted packets to the web server. The device will automatically reboot, impacting network availability for other devices. An attacker must have network access to port 443/tcp to exploit the vulnerability. Neither valid credentials nor interaction by a legitimate user is required to exploit the vulnerability. There is no confidentiality or integrity impact, only availability is temporarily impacted. This vulnerability could be triggered by publicly available tools.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105331; https://cert-portal.siemens.com/productcert/pdf/ssa-447396.pdf; https://ics-cert.us-cert.gov/advisories/ICSA-18-254-05
CVE: CVE-2017-1082
Published: 2018-09-12
Description: In FreeBSD 11.x before 11.1-RELEASE and 10.x before 10.4-RELEASE, the qsort algorithm has a deterministic recursion pattern. Feeding a pathological input to the algorithm can lead to excessive stack usage and potential overflow. Applications that use qsort to handle large data set may crash if the input follows the pathological pattern.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt; https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
CVE: CVE-2017-1083
Published: 2018-09-12
Description: In FreeBSD before 11.2-RELEASE, a stack guard-page is available but is disabled by default. This results in the possibility a poorly written process could be cause a stack overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt; https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
CVE: CVE-2017-1084
Published: 2018-09-12
Description: In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. This results in the possibility a poorly written process could be cause a stack overflow.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42277/; https://www.exploit-db.com/exploits/42278/; https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
CVE: CVE-2017-1085
Published: 2018-09-12
Description: In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://www.exploit-db.com/exploits/42279/; https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt; https://www.exploit-db.com/exploits/42279/
CVE: CVE-2018-1773
Published: 2018-09-12
Description: IBM Datacap Fastdoc Capture 9.1.1, 9.1.3, and 9.1.4 could allow an authenticated user to bypass future authentication mechanisms once the initial login is completed.  IBM X-Force ID: 148691.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/105340; https://exchange.xforce.ibmcloud.com/vulnerabilities/148691; https://www.ibm.com/support/docview.wss?uid=ibm10729013
CVE: CVE-2018-3882
Published: 2018-09-12
Description: An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The searchfield parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560
CVE: CVE-2018-3883
Published: 2018-09-12
Description: An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The employee and sort_order parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560
CVE: CVE-2018-3884
Published: 2018-09-12
Description: An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The sort_by and start parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560
CVE: CVE-2018-3885
Published: 2018-09-12
Description: An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Specially crafted web requests can cause SQL injections resulting in data compromise. The order_by parameter can be used to perform an SQL injection attack. An attacker can use a browser to trigger these vulnerabilities, and no special tools are required.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0560
CVE: CVE-2018-6924
Published: 2018-09-12
Description: In FreeBSD before 11.1-STABLE, 11.2-RELEASE-p3, 11.1-RELEASE-p14, 10.4-STABLE, and 10.4-RELEASE-p12, insufficient validation in the ELF header parser could allow a malicious ELF binary to cause a kernel crash or disclose kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://www.securitytracker.com/id/1041646; https://security.freebsd.org/advisories/FreeBSD-SA-18:12.elf.asc; http://www.securitytracker.com/id/1041646
CVE: CVE-2017-18347
Published: 2018-09-12
Description: Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-362
References: https://community.st.com/s/question/0D50X00009Xke7aSAB/readout-protection-cracked-on-stm32; https://www.aisec.fraunhofer.de/en/FirmwareProtection.html; https://www.usenix.org/conference/woot17/workshop-program/presentation/obermaier
CVE: CVE-2018-7906
Published: 2018-09-12
Description: Some Huawei smart phones with software of Leland-AL00 8.0.0.114(C636), Leland-AL00A 8.0.0.171(C00) have a denial of service (DoS) vulnerability. An attacker can trick a user to install a malicious application to exploit this vulnerability. Due to insufficient verification of the parameter, successful exploitation can cause the smartphone black screen until restarting the phone.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180905-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180905-01-smartphone-en
CVE: CVE-2018-7921
Published: 2018-09-12
Description: Huawei B315s-22 products with software of 21.318.01.00.26 have an information leak vulnerability. Unauthenticated adjacent attackers may exploit this vulnerability to obtain device information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://www.exploit-db.com/exploits/45971/; https://www.huawei.com/en/psirt/security-notices/huawei-sn-20180903-01-b315s-en; https://www.exploit-db.com/exploits/45971/
CVE: CVE-2018-7922
Published: 2018-09-12
Description: Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to exploit the vulnerability. Successful exploit could allow the attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180911-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180911-01-smartphone-en
CVE: CVE-2018-7923
Published: 2018-09-12
Description: Huawei ALP-L09 smart phones with versions earlier than ALP-L09 8.0.0.150(C432) have an insufficient input validation vulnerability due to lack of parameter check. An attacker tricks the user who has root privilege to install a crafted application, the application may modify the specific data to exploit the vulnerability. Successful exploit could allow the attacker to execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180911-01-smartphone-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180911-01-smartphone-en
CVE: CVE-2018-7939
Published: 2018-09-12
Description: Huawei smart phones G9 Lite, Honor 5A, Honor 6X, Honor 8 with the versions before VNS-L53C605B120CUSTC605D103, the versions before CAM-L03C605B143CUSTC605D008, the versions before CAM-L21C10B145, the versions before CAM-L21C185B156, the versions before CAM-L21C223B133, the versions before CAM-L21C432B210, the versions before CAM-L21C464B170, the versions before CAM-L21C636B245, the versions before Berlin-L21C10B372, the versions before Berlin-L21C185B363, the versions before Berlin-L21C464B137, the versions before Berlin-L23C605B161, the versions before FRD-L09C10B387, the versions before FRD-L09C185B387, the versions before FRD-L09C432B398, the versions before FRD-L09C636B387, the versions before FRD-L19C10B387, the versions before FRD-L19C432B399, the versions before FRD-L19C636B387 have a Factory Reset Protection (FRP) bypass security vulnerability. When re-configuring the mobile phone using the factory reset protection (FRP) function, an attacker can disable the boot wizard by enable the talkback function. As a result, the FRP function is bypassed.
CVSS Score: 4.6 (MEDIUM)
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180905-01-frpbypass-en; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180905-01-frpbypass-en
CVE: CVE-2018-13411
Published: 2018-09-12
Description: An issue was discovered in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/105348; https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.md; https://www.manageengine.com/products/desktop-central/elevation-of-system-privilege.html
CVE: CVE-2018-13412
Published: 2018-09-12
Description: An issue was discovered in the Self Service Portal in Zoho ManageEngine Desktop Central before 10.0.282. A clickable company logo in a window running as SYSTEM can be abused to escalate privileges. In cloud, the issue is fixed in 10.0.470 agent version.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/105348; https://github.com/AJ-SA/Zoho-ManageEngine/blob/master/README.md; https://www.manageengine.com/products/desktop-central/elevation-of-system-privilege.html
CVE: CVE-2018-15502
Published: 2018-09-12
Description: Insecure permissions in Lone Wolf Technologies loadingDOCS 2018-08-13 allow remote attackers to download any confidential files via https requests for predictable URLs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://www.ezmax.ca/messages/CVE-2018-15502.html; https://www.ezmax.ca/messages/CVE-2018-15502.html
CVE: CVE-2018-15834
Published: 2018-09-12
Description: In radare2 before 2.9.0, a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://github.com/radare/radare2/issues/11274; https://github.com/radare/radare2/pull/11300; https://github.com/radare/radare2/issues/11274
CVE: CVE-2018-16388
Published: 2018-09-12
Description: e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://gist.github.com/ommadawn46/5cb22e7c66cc32a5c7734a8064b4d3f5; https://github.com/e107inc/e107/commit/e5bb5297f68e56537c004cdbb48a30892e9f6f4c; https://gist.github.com/ommadawn46/5cb22e7c66cc32a5c7734a8064b4d3f5
CVE: CVE-2018-16389
Published: 2018-09-12
Description: e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://gist.github.com/ommadawn46/51e08e13e6980dcbcffb4322c29b93d0; https://github.com/e107inc/e107/commit/ec483e9379aa622bfcc1b853b189c74288771f27; https://gist.github.com/ommadawn46/51e08e13e6980dcbcffb4322c29b93d0
CVE: CVE-2018-16605
Published: 2018-09-12
Description: D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.youtube.com/watch?v=BvZJ_e2BH_M&feature=youtu.be; https://www.youtube.com/watch?v=BvZJ_e2BH_M&feature=youtu.be
CVE: CVE-2018-16726
Published: 2018-09-12
Description: razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/smiffy6969/razorCMS/issues/52; https://github.com/smiffy6969/razorCMS/issues/52
CVE: CVE-2018-16727
Published: 2018-09-12
Description: razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/smiffy6969/razorCMS/issues/51; https://github.com/smiffy6969/razorCMS/issues/51
CVE: CVE-2018-16728
Published: 2018-09-12
Description: feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/frozeman/feindura-flat-file-cms/issues/29; https://github.com/frozeman/feindura-flat-file-cms/issues/29
CVE: CVE-2018-16729
Published: 2018-09-12
Description: Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pluck-cms/pluck/issues/63; https://github.com/pluck-cms/pluck/issues/63
CVE: CVE-2018-7572
Published: 2018-09-12
Description: Pulse Secure Client 9.0R1 and 5.3RX before 5.3R5, when configured to authenticate VPN users during Windows Logon, can allow attackers to bypass Windows authentication and execute commands on the system with the privileges of Pulse Secure Client. The attacker must interrupt the client's network connectivity, and trigger a connection to a crafted proxy server with an invalid SSL certificate that allows certification-manager access, leading to the ability to browse local files and execute local programs.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://www.mdsec.co.uk/2018/09/advisory-cve-2018-7572-pulse-secure-client-authentication-bypass/; https://www.mdsec.co.uk/2018/09/advisory-cve-2018-7572-pulse-secure-client-authentication-bypass/
CVE: CVE-2018-12148
Published: 2018-09-12
Description: Privilege escalation in file permissions in Intel Driver and Support Assistant before 3.5.0.1 may allow an authenticated user to potentially execute code as administrator via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00165.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00165.html
CVE: CVE-2018-12149
Published: 2018-09-12
Description: Buffer overflow in input handling in Intel Extreme Tuning Utility before 6.4.1.21 may allow an authenticated user to potentially deny service to the application via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00162.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00162.html