deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-16557
Published: 2018-12-13
Description: A vulnerability has been identified in  SIMATIC S7-400 CPU 412-1 DP V7 (All versions),  SIMATIC S7-400 CPU 412-2 DP V7 (All versions),  SIMATIC S7-400 CPU 414-2 DP V7 (All versions),  SIMATIC S7-400 CPU 414-3 DP V7 (All versions),  SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 416-2 DP V7 (All versions),  SIMATIC S7-400 CPU 416-3 DP V7 (All versions),  SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 416F-2 DP V7 (All versions),  SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions < V7.0.3),  SIMATIC S7-400 CPU 417-4 DP V7 (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions < V7.0.3), SIMATIC S7-400 H V4.5 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants) (All versions < V6.0.9), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-410 CPU family (incl. SIPLUS variants) (All versions < V8.2.1), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions < V7.0.3), SIPLUS S7-400 CPU 416-3 V7 (All versions), SIPLUS S7-400 CPU 417-4 V7 (All versions). Sending of specially crafted packets to port 102/tcp via Ethernet interface
via PROFIBUS or Multi Point Interfaces (MPI) could cause a denial of service
condition on affected devices. Flashing with a firmware image may be required
to recover the CPU.

Successful exploitation requires an attacker to have network access to port
102/tcp via Ethernet interface or to be able to send messages via PROFIBUS or
Multi Point Interfaces (MPI) to the device. No user interaction is required.
If no access protection is configured, no privileges are required to exploit
the security vulnerability. The vulnerability could allow causing a
denial of service condition of the core functionality of the CPU,
compromising the availability of the system.
CVSS Score: 8.2 (HIGH)
CWE: CWE-347
References: https://cert-portal.siemens.com/productcert/pdf/ssa-113131.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-113131.pdf
CVE: CVE-2018-1665
Published: 2018-12-13
Description: IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=ibm10744195; https://exchange.xforce.ibmcloud.com/vulnerabilities/144891; http://www.ibm.com/support/docview.wss?uid=ibm10744195
CVE: CVE-2018-1667
Published: 2018-12-13
Description: IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144893.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/144893; https://www.ibm.com/support/docview.wss?uid=ibm10744209; https://exchange.xforce.ibmcloud.com/vulnerabilities/144893
CVE: CVE-2018-1740
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148419.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/148419; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1803
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 149702.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-1021
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/149702; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1804
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703.
CVSS Score: 3.7 (LOW)
CWE: CWE-384
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/149703; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1805
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 149704.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/149704; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1813
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017.
CVSS Score: 4.3 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/150017; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1814
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 150018.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/150018; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1815
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150019.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/150019; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1817
Published: 2018-12-13
Description: IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150021.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/150021; https://www.ibm.com/support/docview.wss?uid=ibm10737069; https://exchange.xforce.ibmcloud.com/vulnerabilities/150021
CVE: CVE-2018-1818
Published: 2018-12-13
Description: IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 150022.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/150022; https://www.ibm.com/support/docview.wss?uid=ibm10737073; https://exchange.xforce.ibmcloud.com/vulnerabilities/150022
CVE: CVE-2018-1821
Published: 2018-12-13
Description: IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170.
CVSS Score: 7.1 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/106325; https://exchange.xforce.ibmcloud.com/vulnerabilities/150170; https://www.exploit-db.com/exploits/46017/
CVE: CVE-2018-1886
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 152021.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/152021; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-1887
Published: 2018-12-13
Description: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 152078.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: http://www.ibm.com/support/docview.wss?uid=ibm10787785; https://exchange.xforce.ibmcloud.com/vulnerabilities/152078; http://www.ibm.com/support/docview.wss?uid=ibm10787785
CVE: CVE-2018-20136
Published: 2018-12-13
Description: XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation, as demonstrated by the pages/edit/1?lang=english URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CCCCCrash/POCs/tree/master/Web/fuel-cms/xss2; https://github.com/CCCCCrash/POCs/tree/master/Web/fuel-cms/xss2
CVE: CVE-2018-20137
Published: 2018-12-13
Description: XSS exists in FUEL CMS 1.4.3 via the Page title, Meta description, or Meta keywords during page data management, as demonstrated by the pages/edit/1?lang=english URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/CCCCCrash/POCs/tree/master/Web/fuel-cms/xss1; https://github.com/CCCCCrash/POCs/tree/master/Web/fuel-cms/xss1
CVE: CVE-2018-20138
Published: 2018-12-13
Description: PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://suku90.wordpress.com/2018/12/13/php-b2b-script-stored-xss/; https://suku90.wordpress.com/2018/12/13/php-b2b-script-stored-xss/
CVE: CVE-2018-12076
Published: 2018-12-13
Description: A vulnerability in the UPC bar code of the Avanti Markets MarketCard could allow an unauthenticated, local attacker to access funds within the customer's MarketCard balance, and also could lead to Customer Information Disclosure. The vulnerability is due to lack of proper validation of the UPC bar code present on the MarketCard. An attacker could exploit this vulnerability by generating a copy of a customer's bar code. An exploit could allow the attacker to access all funds located within the MarketCard or allow unauthenticated disclosure of information.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-200
References: https://sorsnce.com/2018/11/13/announcing-cve-2018-12076/; https://sorsnce.com/2018/11/13/announcing-cve-2018-12076/
CVE: CVE-2018-18922
Published: 2018-12-13
Description: add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425
References: https://0day.today/exploit/31658; https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/; https://medium.com/%40javierolmedo/cve-2018-18922-ticketly-1-0-privilege-escalation-add-admin-4d1b3696f367
CVE: CVE-2018-18923
Published: 2018-12-13
Description: AbiSoft Ticketly 1.0 is affected by multiple SQL Injection vulnerabilities through the parameters name, category_id and description in action/addproject.php; kind_id, priority_id, project_id, status_id and title in action/addticket.php; and kind_id and status_id in reports.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://hackpuntes.com/cve-2018-18923-ticketly-1-0-multiples-sql-injections/; https://www.exploit-db.com/exploits/45902/; https://hackpuntes.com/cve-2018-18923-ticketly-1-0-multiples-sql-injections/
CVE: CVE-2018-19039
Published: 2018-12-13
Description: Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.html; http://www.securityfocus.com/bid/105994; https://access.redhat.com/errata/RHSA-2019:0747
CVE: CVE-2018-19118
Published: 2018-12-13
Description: Zoho ManageEngine ADAudit before 5.1 build 5120 allows remote attackers to cause a denial of service (stack-based buffer overflow) via the 'Domain Name' field when adding a new domain.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.manageengine.com/products/active-directory-audit/adaudit-plus-release-notes.html; https://www.manageengine.com/products/active-directory-audit/adaudit-plus-release-notes.html
CVE: CVE-2018-19364
Published: 2018-12-13
Description: hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html; http://www.openwall.com/lists/oss-security/2018/11/20/1; https://lists.debian.org/debian-lts-announce/2019/01/msg00023.html
CVE: CVE-2018-19439
Published: 2018-12-13
Description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4[PII_REDACTED]2602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2018/Nov/58; http://www.securityfocus.com/bid/106006
CVE: CVE-2018-19489
Published: 2018-12-13
Description: v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html; http://www.openwall.com/lists/oss-security/2018/11/26/1; http://www.securityfocus.com/bid/106007
CVE: CVE-2018-20145
Published: 2018-12-13
Description: Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://github.com/eclipse/mosquitto/blob/master/ChangeLog.txt; https://github.com/eclipse/mosquitto/commit/9097577b49b7fdcf45d30975976dd93808ccc0c4; https://github.com/eclipse/mosquitto/issues/1073
CVE: CVE-2018-16872
Published: 2018-12-13
Description: A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-367, CWE-367
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html; http://www.securityfocus.com/bid/106212; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16872
CVE: CVE-2018-15754
Published: 2018-12-13
Description: Cloud Foundry UAA, versions 60 prior to 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-863
References: http://www.securityfocus.com/bid/106240; https://www.cloudfoundry.org/blog/cve-2018-15754; https://www.cloudfoundry.org/blog/cve-2018-15754/
CVE: CVE-2018-15774
Published: 2018-12-13
Description: Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access.
CVSS Score: 3.8 (LOW)
CWE: CWE-863
References: http://www.securityfocus.com/bid/106233; https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en; http://www.securityfocus.com/bid/106233
CVE: CVE-2018-15776
Published: 2018-12-13
Description: Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell.
CVSS Score: 6.4 (MEDIUM)
References: http://www.securityfocus.com/bid/106233; https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en; http://www.securityfocus.com/bid/106233
CVE: CVE-2018-5411
Published: 2018-12-13
Description: Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user. An attacker might include Javascript that could execute on an authenticated user's system that could lead to website redirects, session cookie hijacking, social engineering, etc. As this is stored with the information about the node, all other authenticated users with access to this data are also vulnerable.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106209; https://www.kb.cert.org/vuls/id/756913/; http://www.securityfocus.com/bid/106209
CVE: CVE-2018-12206
Published: 2018-12-14
Description: Improper configuration of hardware access in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00211.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00211.html
CVE: CVE-2018-14623
Published: 2018-12-14
Description: A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-209, CWE-89
References: http://www.securityfocus.com/bid/106224; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14623; http://www.securityfocus.com/bid/106224
CVE: CVE-2018-18093
Published: 2018-12-14
Description: Improper file permissions in the installer for Intel VTune Amplifier 2018 Update 3 and before may allow unprivileged user to potentially gain privileged access via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00194.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00194.html
CVE: CVE-2018-18096
Published: 2018-12-14
Description: Improper memory handling in Intel QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00211.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00211.html
CVE: CVE-2018-18097
Published: 2018-12-14
Description: Improper directory permissions in Intel Solid State Drive Toolbox before 3.5.7 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00205.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00205.html
CVE: CVE-2018-3704
Published: 2018-12-14
Description: Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially enable an escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00208.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00208.html
CVE: CVE-2018-3705
Published: 2018-12-14
Description: Improper directory permissions in the installer for the Intel(R) System Defense Utility (all versions) may allow authenticated users to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00209.html; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00209.html
CVE: CVE-2018-6707
Published: 2018-12-14
Description: Denial of Service through Resource Depletion vulnerability in the agent in non-Windows McAfee Agent (MA) 5.0.0 through 5.0.6, 5.5.0, and 5.5.1 allows local users to cause DoS, unexpected behavior, or potentially unauthorized code execution via knowledge of the internal trust mechanism.
CVSS Score: 3.7 (LOW)
CWE: CWE-400
References: http://www.securityfocus.com/bid/106307; https://kc.mcafee.com/corporate/index?page=content&id=SB10260; http://www.securityfocus.com/bid/106307