deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: OpenModelica OMCompiler is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: OPENMODELICAHOME parameter changeable via environment variable. The attack vector is: Changing an environment variable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://trac.openmodelica.org/OpenModelica/ticket/4787#trac-add-comment; https://trac.openmodelica.org/OpenModelica/ticket/4787#trac-add-comment
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: uLaunchELF < commit 170827a is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Loader program (loader.c) overly trusts the arguments provided via command line.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/AKuHAK/uLaunchELF/issues/14; https://github.com/AKuHAK/uLaunchELF/issues/14
CVE: CVE-2019-13604
Published: 2019-07-15
Description: There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerprint image is vulnerable to brute-force attacks. This allows an attacker to recover the key and decrypt that image using the key. Successful exploitation causes a sensitive biometric information leak.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-327
References: https://github.com/sungjungk/fp-img-key-crack; https://www.youtube.com/watch?v=7tKJQdKRm2k; https://www.youtube.com/watch?v=BwYK_xZlKi4
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Saleor Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release is affected by: Incorrect Access Control. The impact is: Important. The component is: ProductVariant type in GraphQL API. The attack vector is: Unauthenticated user can access the GraphQL API (which is by default publicly exposed under `/graphql/` URL) and fetch products data which may include admin-restricted shop's revenue data. The fixed version is: 2.3.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://github.com/mirumee/saleor/issues/3768; https://github.com/mirumee/saleor/issues/3768
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: libmspack 0.9.1alpha is affected by: Buffer Overflow. The impact is: Information Disclosure. The component is: function chmd_read_headers() in libmspack(file libmspack/mspack/chmd.c). The attack vector is: the victim must open a specially crafted chm file. The fixed version is: after commit 2f084136cfe0d05e5bf5703f3e83c6d955234b4d.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://github.com/kyz/libmspack/commit/2f084136cfe0d05e5bf5703f3e83c6d955234b4d; https://github.com/kyz/libmspack/issues/27; https://lists.debian.org/debian-lts-announce/2019/08/msg00028.html
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Slanger 0.6.0 is affected by: Remote Code Execution (RCE). The impact is: A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is: Message handler & request validator. The attack vector is: Remote unauthenticated. The fixed version is: after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3; https://github.com/stevegraham/slanger/pull/238/commits/5267b455caeb2e055cccf0d2b6a22727c111f5c3
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-7662. Reason: This candidate is a reservation duplicate of CVE-2018-7662. Notes: All CVE users should reference CVE-2018-7662 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: borg-reducer c6d5240 is affected by: Buffer Overflow. The impact is: Possible code execution and denial of service. The component is: Output parameter within the executable.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/archivesunleashed/borg-reducer/issues/4; https://github.com/archivesunleashed/borg-reducer/issues/4
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Boundary crossing. The impact is: Memory corruption of the TEE itself. The component is: optee_os. The fixed version is: 3.4.0 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/OP-TEE/optee_os/commit/95f36d661f2b75887772ea28baaad904bde96970; https://github.com/OP-TEE/optee_os/commit/95f36d661f2b75887772ea28baaad904bde96970
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Rounding error. The impact is: Potentially leaking code and/or data from previous Trusted Application. The component is: optee_os. The fixed version is: 3.4.0 and later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: https://github.com/OP-TEE/optee_os/commit/7e768f8a473409215fe3fff8f6e31f8a3a0103c6; https://github.com/OP-TEE/optee_os/commit/7e768f8a473409215fe3fff8f6e31f8a3a0103c6
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Memory corruption and disclosure of memory content. The component is: optee_os. The fixed version is: 3.4.0 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-125, CWE-787
References: https://github.com/OP-TEE/optee_os/commit/d5c5b0b77b2b589666024d219a8007b3f5b6faeb; https://github.com/OP-TEE/optee_os/commit/d5c5b0b77b2b589666024d219a8007b3f5b6faeb
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://github.com/OP-TEE/optee_os/commit/b60e1cee406a1ff521145ab9534370dfb85dd592; https://github.com/OP-TEE/optee_os/commit/b60e1cee406a1ff521145ab9534370dfb85dd592
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component is: optee_os. The fixed version is: 3.4.0 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://github.com/OP-TEE/optee_os/commit/a637243270fc1faae16de059091795c32d86e65e; https://github.com/OP-TEE/optee_os/commit/a637243270fc1faae16de059091795c32d86e65e
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in the context of TEE core (kernel). The component is: optee_os. The fixed version is: 3.4.0 and later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://github.com/OP-TEE/optee_os/commit/70697bf3c5dc3d201341b01a1a8e5bc6d2fb48f8; https://github.com/OP-TEE/optee_os/commit/70697bf3c5dc3d201341b01a1a8e5bc6d2fb48f8
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: The Rust Programming Language Standard Library 1.18.0 and later is affected by: CWE-200: Information Exposure. The impact is: Contents of uninitialized memory could be printed to string or to log file. The component is: Debug trait implementation for std::collections::vec_deque::Iter. The attack vector is: The program needs to invoke debug printing for iterator over an empty VecDeque. The fixed version is: 1.30.0, nightly versions after commit b85e4cc8fadaabd41da5b9645c08c68b8f89908d.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-908
References: https://github.com/rust-lang/rust/issues/53566; https://github.com/rust-lang/rust/pull/53571/commits/b85e4cc8fadaabd41da5b9645c08c68b8f89908d; https://github.com/rust-lang/rust/issues/53566
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: mz-automation libiec61850 1.3.2 1.3.1 1.3.0 is affected by: Buffer Overflow. The impact is: Software crash. The component is: server_example_complex_array. The attack vector is: Send a specific MMS protocol packet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/mz-automation/libiec61850/issues/127; https://github.com/mz-automation/libiec61850/issues/127
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: jhead 3.03 is affected by: Buffer Overflow. The impact is: Denial of service. The component is: gpsinfo.c Line 151 ProcessGpsInfo(). The attack vector is: Open a specially crafted JPEG file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1838251; https://bugzilla.redhat.com/show_bug.cgi?id=1679952; https://launchpadlibrarian.net/435112680/32_crash_in_gpsinfo
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: jhead 3.03 is affected by: Incorrect Access Control. The impact is: Denial of service. The component is: iptc.c Line 122 show_IPTC(). The attack vector is: the victim must open a specially crafted JPEG file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://bugzilla.redhat.com/show_bug.cgi?id=1679978; https://lists.debian.org/debian-lts-announce/2019/12/msg00037.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WVQTORTGQE56XXC6OVHQCSCUGABRMQZ/
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/glpi-project/glpi/blob/9.4/bugfixes/ajax/getDropdownValue.php; https://github.com/glpi-project/glpi/releases/tag/9.3.1; https://github.com/glpi-project/glpi/blob/9.4/bugfixes/ajax/getDropdownValue.php
CVE: CVE-2[PII_REDACTED]
Published: 2019-07-15
Description: Aquaverde GmbH Aquarius CMS prior to version 4.1.1 is affected by: Incorrect Access Control. The impact is: The access to the log file is not restricted. It contains sensitive information like passwords etc. The component is: log file. The attack vector is: open the file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://github.com/aquaverde/aquarius-core; https://github.com/aquaverde/aquarius-core/commit/e1af89aa9df07ea265d879518ede9eb98aa494e0; https://github.com/aquaverde/aquarius-core
CVE: CVE-2019-5447
Published: 2019-07-15
Description: A path traversal vulnerability in <= v0.2.6 of http-file-server npm module allows attackers to list files in arbitrary folders.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/570133; https://hackerone.com/reports/570133
CVE: CVE-2019-0785
Published: 2019-07-15
Description: A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0785; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0785
CVE: CVE-2019-0811
Published: 2019-07-15
Description: A denial of service vulnerability exists in Windows DNS Server when it fails to properly handle DNS queries, aka 'Windows DNS Server Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0811; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0811
CVE: CVE-2019-0865
Published: 2019-07-15
Description: A denial of service vulnerability exists when SymCrypt improperly handles a specially crafted digital signature.An attacker could exploit the vulnerability by creating a specially crafted connection or message.The security update addresses the vulnerability by correcting the way SymCrypt handles digital signatures., aka 'SymCrypt Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0865; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0865
CVE: CVE-2019-0880
Published: 2019-07-15
Description: A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0880; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0880; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0880
CVE: CVE-2019-0887
Published: 2019-07-15
Description: A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard redirection, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/108964; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0887; https://research.checkpoint.com/reverse-rdp-attack-code-execution-on-rdp-clients/
CVE: CVE-2019-0962
Published: 2019-07-15
Description: An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Automation Elevation of Privilege Vulnerability'.
CVSS Score: 4.9 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0962; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0962
CVE: CVE-2019-0966
Published: 2019-07-15
Description: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0966; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0966
CVE: CVE-2019-0975
Published: 2019-07-15
Description: A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP addresses. This security update corrects how ADFS updates its list of banned IP addresses., aka 'ADFS Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-1126.
CVSS Score: 6.3 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0975; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0975
CVE: CVE-2019-0999
Published: 2019-07-15
Description: An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0999; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0999
CVE: CVE-2019-1001
Published: 2019-07-15
Description: A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1004, CVE-2019-1056, CVE-2019-1059.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1001; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1001
CVE: CVE-2019-1004
Published: 2019-07-15
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001, CVE-2019-1056, CVE-2019-1059.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1004; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1004
CVE: CVE-2019-1006
Published: 2019-07-15
Description: An authentication bypass vulnerability exists in Windows Communication Foundation (WCF) and Windows Identity Foundation (WIF), allowing signing of SAML tokens with arbitrary symmetric keys, aka 'WCF/WIF SAML Token Authentication Bypass Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1006; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1006
CVE: CVE-2019-1037
Published: 2019-07-15
Description: An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
CVSS Score: 7.0 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1037; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1037
CVE: CVE-2019-1056
Published: 2019-07-15
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001, CVE-2019-1004, CVE-2019-1059.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1056; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1056
CVE: CVE-2019-1059
Published: 2019-07-15
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1001, CVE-2019-1004, CVE-2019-1056.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1059; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1059
CVE: CVE-2019-1062
Published: 2019-07-15
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1092, CVE-2019-1103, CVE-2019-1106, CVE-2019-1107.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1062; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1062
CVE: CVE-2019-1063
Published: 2019-07-15
Description: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka 'Internet Explorer Memory Corruption Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1063; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1063
CVE: CVE-2019-1067
Published: 2019-07-15
Description: An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1067; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1067
CVE: CVE-2019-1068
Published: 2019-07-15
Description: A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
CVE: CVE-2019-1071
Published: 2019-07-15
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1073.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1071; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1071
CVE: CVE-2019-1072
Published: 2019-07-15
Description: A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server and Team Foundation Server Remote Code Execution Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1072
CVE: CVE-2019-1073
Published: 2019-07-15
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1071.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1073; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1073
CVE: CVE-2019-1074
Published: 2019-07-15
Description: An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to symbolic link attack. An attacker who successfully exploited this vulnerability could potentially access unauthorized information. The update addresses this vulnerability by not allowing symbolic links in these scenarios., aka 'Microsoft Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1082.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1074; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1074
CVE: CVE-2019-1075
Published: 2019-07-15
Description: A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1075; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1075
CVE: CVE-2019-1076
Published: 2019-07-15
Description: A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1076; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1076
CVE: CVE-2019-1077
Published: 2019-07-15
Description: An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual Studio Elevation of Privilege Vulnerability'.
CVSS Score: 5.0 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1077; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1077