deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7167
Published: 2018-06-13
Description: Calling Buffer.fill() or Buffer.alloc() with some parameters can lead to a hang which could result in a Denial of Service. In order to address this vulnerability, the implementations of Buffer.alloc() and Buffer.fill() were updated so that they zero fill instead of hanging in these cases. All versions of Node.js 6.x (LTS "Boron"), 8.x (LTS "Carbon"), and 9.x are vulnerable. All versions of Node.js 10.x (Current) are NOT vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/106363; https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/; https://security.gentoo.org/glsa/202003-48
CVE: CVE-2017-15695
Published: 2018-06-13
Description: When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.securityfocus.com/bid/104465; https://lists.apache.org/thread.html/dc8875c0b924885a884eba6d5bd7dc3f123411b2d33cffd00e351c99%40%3Cuser.geode.apache.org%3E; http://www.securityfocus.com/bid/104465
CVE: CVE-2017-11672
Published: 2018-06-13
Description: The OPC Foundation Local Discovery Server (LDS) before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-11672.pdf; https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-11672.pdf
CVE: CVE-2017-17443
Published: 2018-06-13
Description: OPC Foundation Local Discovery Server (LDS) 1.03.370 required a security update to resolve multiple vulnerabilities that allow attackers to trigger a crash by placing invalid data into the configuration file. This vulnerability requires an attacker with access to the file system where the configuration file is stored; however, if the configuration file is altered the LDS will be unavailable until it is repaired.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-17443.pdf; https://opcfoundation-onlineapplications.org/faq/SecurityBulletins/OPC_Foundation_Security_Bulletin_CVE-2017-17443.pdf
CVE: CVE-2018-10363
Published: 2018-06-13
Description: An issue was discovered in the WpDevArt "Booking calendar, Appointment Booking System" plugin 2.2.2 for WordPress. Multiple parameters allow remote attackers to manipulate the values to change data such as prices.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://gist.github.com/B0UG/68d3161af0c0ec85c615ca7452f9755e; https://gist.github.com/B0UG/68d3161af0c0ec85c615ca7452f9755e
CVE: CVE-2018-7559
Published: 2018-06-13
Description: An issue was discovered in OPC UA .NET Standard Stack and Sample Code before GitHub commit 2018-04-12, and OPC UA .NET Legacy Stack and Sample Code before GitHub commit 2018-03-13. A vulnerability in OPC UA applications can allow a remote attacker to determine a Server's private key by sending carefully constructed bad UserIdentityTokens as part of an oracle attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-320
References: http://www.securityfocus.com/bid/108688; https://github.com/OPCFoundation/UA-.NET-Legacy/commit/e2a781b38efb8686d2bd850c2f2372b5c670bc45; https://github.com/OPCFoundation/UA-.NETStandard/commit/ebcf026a54dd0c9052cff009d96d827ac923d150
CVE: CVE-2018-12339
Published: 2018-06-13
Description: ArticleCMS through 2017-02-19 has XSS via an "add an article" action.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/woider/ArticleCMS/issues/4; https://github.com/woider/ArticleCMS/issues/4
CVE: CVE-2017-3968
Published: 2018-06-13
Description: Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-384
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10192; https://kc.mcafee.com/corporate/index?page=content&id=SB10198; https://kc.mcafee.com/corporate/index?page=content&id=SB10192
CVE: CVE-2018-10850
Published: 2018-06-13
Description: 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-362, CWE-362
References: http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html; https://access.redhat.com/errata/RHSA-2018:2757; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10850
CVE: CVE-2018-1121
Published: 2018-06-13
Description: procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.
CVSS Score: 3.9 (LOW)
CWE: CWE-367, CWE-362
References: http://seclists.org/oss-sec/2018/q2/122; http://www.securityfocus.com/bid/104214; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121
CVE: CVE-2018-5488
Published: 2018-06-13
Description: NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network, and are susceptible to unauthenticated remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104462; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; http://www.securityfocus.com/bid/104462
CVE: CVE-2017-3907
Published: 2018-06-13
Description: Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-94
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10207; https://kc.mcafee.com/corporate/index?page=content&id=SB10207
CVE: CVE-2017-3936
Published: 2018-06-13
Description: OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-78
References: http://www.securityfocus.com/bid/103155; https://kc.mcafee.com/corporate/index?page=content&id=SB10227; http://www.securityfocus.com/bid/103155
CVE: CVE-2018-10403
Published: 2018-06-13
Description: An issue was discovered in F-Secure XFENCE and Little Flocker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/; https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
CVE: CVE-2018-10404
Published: 2018-06-13
Description: An issue was discovered in Objective-See KnockKnock, LuLu, TaskExplorer, WhatsYourSign, and procInfo. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/; https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
CVE: CVE-2018-10405
Published: 2018-06-13
Description: An issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/; https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
CVE: CVE-2018-10406
Published: 2018-06-13
Description: An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/; https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
CVE: CVE-2018-10407
Published: 2018-06-13
Description: An issue was discovered in Carbon Black Cb Response. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-347
References: https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/; https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
CVE: CVE-2018-10408
Published: 2018-06-13
Description: An issue was discovered in VirusTotal. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
CVSS Score: 7.8 (HIGH)
CWE: CWE-295
References: https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/; https://www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/
CVE: CVE-2018-12040
Published: 2018-06-13
Description: Reflected Cross-site scripting (XSS) vulnerability in the web profiler in SensioLabs Symfony 3.3.6 allows remote attackers to inject arbitrary web script or HTML via the "file" parameter, aka an _profiler/open?file= URI.  NOTE: The vendor states "The XSS ... is in the web profiler, a tool that should never be deployed in production (so, we don't handle those issues as security issues).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/148125/SensioLabs-Symfony-3.3.6-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/542071/100/0/threaded; http://packetstormsecurity.com/files/148125/SensioLabs-Symfony-3.3.6-Cross-Site-Scripting.html
CVE: CVE-2018-0495
Published: 2018-06-13
Description: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-203
References: http://www.securitytracker.com/id/1041144; http://www.securitytracker.com/id/1041147; https://access.redhat.com/errata/RHSA-2018:3221
CVE: CVE-2018-12019
Published: 2018-06-13
Description: The signature verification routine in Enigmail before 2.0.7 interprets user ids as status/control messages and does not correctly keep track of the status of multiple signatures, which allows remote attackers to spoof arbitrary email signatures via public keys containing crafted primary user ids.
CVSS Score: 7.5 (HIGH)
CWE: CWE-347
References: http://openwall.com/lists/oss-security/2018/06/13/10; http://packetstormsecurity.com/files/152703/Johnny-You-Are-Fired.html; http://seclists.org/fulldisclosure/2019/Apr/38
CVE: CVE-2018-12271
Published: 2018-06-13
Description: An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-287
References: https://gist.github.com/tanprathan/6e8ed195a2e05b7f9d9a342dbdacb349; https://hackerone.com/reports/363544; https://www.dropbox.com/s/n880ob3gtvfwryu/20180609_013320.mp4?dl=0
CVE: CVE-2018-12353
Published: 2018-06-13
Description: Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the "Business Model's Catalogue" catalogue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55; https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55
CVE: CVE-2018-12354
Published: 2018-06-13
Description: Knowage (formerly SpagoBI) 6.1.1 allows CSRF via every form, as demonstrated by a /knowage/restful-services/2.0/analyticalDrivers/ POST request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55; https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55
CVE: CVE-2018-12355
Published: 2018-06-13
Description: Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55; https://medium.com/stolabs/security-issue-on-knowage-spagobi-ec539a68e55
CVE: CVE-2018-0871
Published: 2018-06-14
Description: An information disclosure vulnerability exists when Edge improperly marks files, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8234.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104339; http://www.securitytracker.com/id/1041097; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0871
CVE: CVE-2018-0978
Published: 2018-06-14
Description: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8249.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104364; http://www.securitytracker.com/id/1041099; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0978
CVE: CVE-2018-0982
Published: 2018-06-14
Description: An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/104382; http://www.securitytracker.com/id/1041093; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0982
CVE: CVE-2018-1036
Published: 2018-06-14
Description: An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS Score: 7.0 (HIGH)
CWE: CWE-732
References: http://www.securityfocus.com/bid/104360; http://www.securitytracker.com/id/1041111; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1036
CVE: CVE-2018-1040
Published: 2018-06-14
Description: A denial of service vulnerability exists in the way that the Windows Code Integrity Module performs hashing, aka "Windows Code Integrity Module Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/104389; http://www.securitytracker.com/id/1041112; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1040
CVE: CVE-2018-8110
Published: 2018-06-14
Description: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8111, CVE-2018-8236.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104330; http://www.securitytracker.com/id/1041097; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8110
CVE: CVE-2018-8111
Published: 2018-06-14
Description: A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8110, CVE-2018-8236.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/104335; http://www.securitytracker.com/id/1041097; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8111
CVE: CVE-2018-8113
Published: 2018-06-14
Description: A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mark of the Web Tagging (MOTW), aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104365; http://www.securitytracker.com/id/1041099; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8113
CVE: CVE-2018-8121
Published: 2018-06-14
Description: An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10. This CVE ID is unique from CVE-2018-8207.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-665
References: http://www.securityfocus.com/bid/104380; http://www.securitytracker.com/id/1041113; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8121
CVE: CVE-2018-8140
Published: 2018-06-14
Description: An Elevation of Privilege vulnerability exists when Cortana retrieves data from user input services without consideration for status, aka "Cortana Elevation of Privilege Vulnerability." This affects Windows 10 Servers, Windows 10.
CVSS Score: 6.8 (MEDIUM)
References: http://www.securityfocus.com/bid/104354; http://www.securitytracker.com/id/1041108; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8140
CVE: CVE-2018-8169
Published: 2018-06-14
Description: An elevation of privilege vulnerability exists when the (Human Interface Device) HID Parser Library driver improperly handles objects in memory, aka "HIDParser Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS Score: 7.0 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/104356; http://www.securitytracker.com/id/1041093; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8169
CVE: CVE-2018-8175
Published: 2018-06-14
Description: An denial of service vulnerability exists when Windows NT WEBDAV Minirdr attempts to query a WEBDAV directory, aka "WEBDAV Denial of Service Vulnerability." This affects Windows 10 Servers, Windows 10.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104359; http://www.securitytracker.com/id/1041100; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8175
CVE: CVE-2018-8201
Published: 2018-06-14
Description: A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session, aka "Device Guard Code Integrity Policy Security Feature Bypass Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8211, CVE-2018-8212, CVE-2018-8215, CVE-2018-8216, CVE-2018-8217, CVE-2018-8221.
CVSS Score: 4.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104331; http://www.securitytracker.com/id/1041098; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8201
CVE: CVE-2018-8205
Published: 2018-06-14
Description: A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/104391; http://www.securitytracker.com/id/1041114; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8205
CVE: CVE-2018-8207
Published: 2018-06-14
Description: An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8121.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104379; http://www.securitytracker.com/id/1041113; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8207
CVE: CVE-2018-8208
Published: 2018-06-14
Description: An elevation of privilege vulnerability exists in Windows when Desktop Bridge does not properly manage the virtual registry, aka "Windows Desktop Bridge Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8214.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/104392; http://www.securitytracker.com/id/1041093; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8208