deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1768
Published: 2019-05-16
Description: A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119, CWE-78
References: http://www.securityfocus.com/bid/108386; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-overflow-inj; http://www.securityfocus.com/bid/108386
CVE: CVE-2019-1832
Published: 2019-05-16
Description: A vulnerability in the detection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access control policies. The vulnerability is due to improper validation of ICMP packets. An attacker could exploit this vulnerability by sending crafted ICMP packets to the affected device. A successful exploit could allow the attacker to bypass configured access control policies.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-693, CWE-693
References: http://www.securityfocus.com/bid/108340; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-ftdde-poly-bypass; http://www.securityfocus.com/bid/108340
CVE: CVE-2019-1833
Published: 2019-05-16
Description: A vulnerability in the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) protocol parser of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies. The vulnerability is due to improper parsing of specific attributes in a TLS packet header. An attacker could exploit this vulnerability by sending malicious TLS messages to the affected system. A successful exploit could allow the attacker to bypass the configured policies for the system, which could allow traffic to flow through without being inspected.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-693, CWE-693
References: http://www.securityfocus.com/bid/108338; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-ftd-ssltls-bypass; http://www.securityfocus.com/bid/108338
CVE: CVE-2019-1846
Published: 2019-05-16
Description: A vulnerability in the Multiprotocol Label Switching (MPLS) Operations, Administration, and Maintenance (OAM) implementation of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to the incorrect handling of certain MPLS OAM packets. An attacker could exploit this vulnerability by sending malicious MPLS OAM packets to an affected device. A successful exploit could allow the attacker to cause the lspv_server process to crash. The crash could lead to system instability and the inability to process or forward traffic though the device, resulting in a DoS condition that require manual intervention to restore normal operating conditions.
CVSS Score: 7.4 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108363; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-asr9k-mpls-dos; http://www.securityfocus.com/bid/108363
CVE: CVE-2019-1849
Published: 2019-05-16
Description: A vulnerability in the Border Gateway Patrol (BGP) Multiprotocol Label Switching (MPLS)-based Ethernet VPN (EVPN) implementation of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition on an affected device. The vulnerability is due to a logic error that occurs when the affected software processes specific EVPN routing information. An attacker could exploit this vulnerability by injecting malicious traffic patterns into the targeted EVPN network. A successful exploit could result in a crash of the l2vpn_mgr process on Provider Edge (PE) device members of the same EVPN instance (EVI). On each of the affected devices, a crash could lead to system instability and the inability to process or forward traffic through the device, resulting in a DoS condition that would require manual intervention to restore normal operating conditions.
CVSS Score: 7.4 (HIGH)
CWE: CWE-754, CWE-754
References: http://www.securityfocus.com/bid/108342; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-iosxr-evpn-dos; http://www.securityfocus.com/bid/108342
CVE: CVE-2019-1851
Published: 2019-05-16
Description: A vulnerability in the External RESTful Services (ERS) API of the Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority (CA) Services on ISE. This vulnerability is due to an incorrect implementation of role-based access control (RBAC). An attacker could exploit this vulnerability by crafting a specific HTTP request with administrative credentials. A successful exploit could allow the attacker to generate a certificate that is signed and trusted by the ISE CA with arbitrary attributes. The attacker could use this certificate to access other networks or assets that are protected by certificate authentication.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-285
References: http://www.securityfocus.com/bid/108356; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-ise-certcreation; http://www.securityfocus.com/bid/108356
CVE: CVE-2019-1853
Published: 2019-05-16
Description: A vulnerability in the HostScan component of Cisco AnyConnect Secure Mobility Client for Linux could allow an unauthenticated, remote attacker to read sensitive information on an affected system. The vulnerability exists because the affected software performs improper bounds checks. An attacker could exploit this vulnerability by crafting HTTP traffic for the affected component to download and process. A successful exploit could allow the attacker to read sensitive information on the affected system.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-125, CWE-125
References: http://www.securityfocus.com/bid/108364; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-anyconnectclient-oob-read; http://www.securityfocus.com/bid/108364
CVE: CVE-2019-1858
Published: 2019-05-16
Description: A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the SNMP application to leak system memory, which could cause an affected device to restart unexpectedly. The vulnerability is due to improper error handling when processing inbound SNMP packets. An attacker could exploit this vulnerability by sending multiple crafted SNMP packets to an affected device. A successful exploit could allow the attacker to cause the SNMP application to leak system memory because of an improperly handled error condition during packet processing. Over time, this memory leak could cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-755
References: http://www.securityfocus.com/bid/108358; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-snmp-dos; http://www.securityfocus.com/bid/108358
CVE: CVE-2019-1860
Published: 2019-05-16
Description: A vulnerability in the dashboard gadget rendering of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to obtain or manipulate sensitive information between a user&rsquo;s browser and Cisco Unified Intelligence Center. The vulnerability is due to the lack of gadget validation. An attacker could exploit this vulnerability by forcing a user to load a malicious gadget. A successful exploit could allow the attacker to obtain sensitive information, such as current user credentials, or manipulate data between the user&rsquo;s browser and Cisco Unified Intelligence Center in the context of the malicious gadget.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-99, CWE-99
References: http://www.securityfocus.com/bid/108354; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-cuic-cmdinj; http://www.securityfocus.com/bid/108354
CVE: CVE-2019-12136
Published: 2019-05-16
Description: There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/BoostIO/Boostnote/issues/3007; https://github.com/BoostIO/Boostnote/issues/3007
CVE: CVE-2019-12137
Published: 2019-05-16
Description: Typora 0.9.9.24.6 on macOS allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://packetstormsecurity.com/files/153082/Typora-0.9.9.24.6-Directory-Traversal.html; https://github.com/typora/typora-issues/issues/2505; https://twitter.com/RandomDhiraj/status/[PII_REDACTED]40915712
CVE: CVE-2019-12138
Published: 2019-05-16
Description: MacDown 0.7.1 allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: https://github.com/MacDownApp/macdown/issues/1076; https://github.com/MacDownApp/macdown/issues/1076
CVE: CVE-2018-17048
Published: 2019-05-16
Description: admin/Lib/Action/FpluginAction.class.php in FDCMS (aka Fangfa Content Manage System) 4.2 allows SQL Injection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.cnvd.org.cn/flaw/show/CNVD-2018-19263; http://www.fangfacms.com/; https://github.com/badongdyc/fangfacms/commits/master
CVE: CVE-2018-1975
Published: 2019-05-16
Description: IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153916.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10883198; https://exchange.xforce.ibmcloud.com/vulnerabilities/153916; http://www.ibm.com/support/docview.wss?uid=ibm10883198
CVE: CVE-2019-10113
Published: 2019-05-16
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Making concurrent GET /api/v4/projects/<id>/languages requests may allow Uncontrolled Resource Consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54977
CVE: CVE-2019-10114
Published: 2019-05-16
Description: An Information Exposure issue (issue 2 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. During the OAuth authentication process, the application attempts to validate a parameter in an insecure way, potentially exposing data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ee/issues/9729
CVE: CVE-2019-10115
Published: 2019-05-16
Description: An Insecure Permissions issue (issue 2 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The GitLab Releases feature could allow guest users access to private information like release details and code information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/56402
CVE: CVE-2019-10116
Published: 2019-05-16
Description: An Insecure Permissions issue (issue 3 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. Guests of a project were allowed to see Related Branches created for an issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/56224
CVE: CVE-2019-10117
Published: 2019-05-16
Description: An Open Redirect issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. A redirect is triggered after successful authentication within the Oauth/:GeoAuthController for the secondary Geo node.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ee/issues/9731
CVE: CVE-2019-11033
Published: 2019-05-16
Description: Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.applaudsolutions.com/hc/en-us/articles/203794318-Download-latest-Applaud-HCM-patch; https://www.applaudsolutions.com/resources/; https://support.applaudsolutions.com/hc/en-us/articles/203794318-Download-latest-Applaud-HCM-patch
CVE: CVE-2019-12139
Published: 2019-05-16
Description: An XSS issue was discovered in the Admin UI in eZ Platform 2.x. This affects ezplatform-admin-ui 1.3.x before 1.3.5 and 1.4.x before 1.4.4, and ezplatform-page-builder 1.1.x before 1.1.5 and 1.2.x before 1.2.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui; https://share.ez.no/community-project/security-advisories/ezsa-2019-001-xss-in-admin-ui
CVE: CVE-2019-10112
Published: 2019-05-16
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The construction of the HMAC key was insecurely derived.
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ee/issues/9730
CVE: CVE-2018-12556
Published: 2019-05-16
Description: The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any (arbitrary) key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn release packages with their own key.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347
References: http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html; http://seclists.org/fulldisclosure/2019/Apr/38; https://github.com/RUB-NDS/Johnny-You-Are-Fired
CVE: CVE-2019-1780
Published: 2019-05-16
Description: A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying operating system of an affected device with elevated privileges. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. NX-OS versions prior to 8.3(1) are affected. NX-OS versions prior to 8.3(1) are affected.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108392; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1780; http://www.securityfocus.com/bid/108392
CVE: CVE-2019-8338
Published: 2019-05-16
Description: The signature verification routine in the Airmail GPG-PGP Plugin, versions 1.0 (9) and earlier, does not verify the status of the signature at all, which allows remote attackers to spoof arbitrary email signatures by crafting a signed email with an invalid signature. Also, it does not verify the validity of the signing key, which allows remote attackers to spoof arbitrary email signatures by crafting a key with a fake user ID (email address) and injecting it into the user's keyring.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-347
References: http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html; http://seclists.org/fulldisclosure/2019/Apr/38; https://github.com/Airmail/AirmailPlugIn-Framework/commits/master
CVE: CVE-2018-20007
Published: 2019-05-16
Description: Yeelight Smart AI Speaker 3.3.10_0074 devices have improper access control over the UART interface, allowing physical attackers to obtain a root shell. The attacker can then exfiltrate the audio data, read cleartext Wi-Fi credentials in a log file, or access other sensitive device and user information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-732
References: https://forum.yeelight.com/; https://payatu.com/yeelight-smart-ai-speaker-responsible-disclosure/; https://forum.yeelight.com/
CVE: CVE-2019-0707
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it.To exploit the vulnerability, in a local attack scenario, an attacker could run a specially crafted application to elevate the attacker's privilege level, aka 'Windows NDIS Elevation of Privilege Vulnerability'.
CVSS Score: 7.0 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0707; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0707
CVE: CVE-2019-0708
Published: 2019-05-16
Description: A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: http://packetstormsecurity.com/files/153133/Microsoft-Windows-Remote-Desktop-BlueKeep-Denial-Of-Service.html; http://packetstormsecurity.com/files/153627/Microsoft-Windows-RDP-BlueKeep-Denial-Of-Service.html; http://packetstormsecurity.com/files/154579/BlueKeep-RDP-Remote-Windows-Kernel-Use-After-Free.html
CVE: CVE-2019-0725
Published: 2019-05-16
Description: A memory corruption vulnerability exists in the Windows Server DHCP service when processing specially crafted packets, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0725; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0725
CVE: CVE-2019-0727
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the system, aka 'Diagnostic Hub Standard Collector, Visual Studio Standard Collector Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0727; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0727
CVE: CVE-2019-0733
Published: 2019-05-16
Description: A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.
CVSS Score: 5.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0733; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0733
CVE: CVE-2019-0734
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully decode and replace authentication request using Kerberos, allowing an attacker to be validated as an Administrator.The update addresses this vulnerability by changing how these requests are validated., aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0936.
CVSS Score: 8.1 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0734; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0734
CVE: CVE-2019-0758
Published: 2019-05-16
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-0882, CVE-2019-0961.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0758; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0758
CVE: CVE-2019-0819
Published: 2019-05-16
Description: An information disclosure vulnerability exists in Microsoft SQL Server Analysis Services when it improperly enforces metadata permissions, aka 'Microsoft SQL Server Analysis Services Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0819; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0819
CVE: CVE-2019-0820
Published: 2019-05-16
Description: A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://access.redhat.com/errata/RHSA-2019:1259; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0820; https://access.redhat.com/errata/RHSA-2019:1259
CVE: CVE-2019-0863
Published: 2019-05-16
Description: An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/153008/Angry-Polar-Bear-2-Microsoft-Windows-Error-Reporting-Local-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0863; http://packetstormsecurity.com/files/153008/Angry-Polar-Bear-2-Microsoft-Windows-Error-Reporting-Local-Privilege-Escalation.html
CVE: CVE-2019-0864
Published: 2019-05-16
Description: A denial of service vulnerability exists when .NET Framework improperly handles objects in heap memory, aka '.NET Framework Denial of Service Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0864; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0864