deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-15475
Published: 2019-11-14
Description: The Xiaomi Mi A3 Android device with a build fingerprint of xiaomi/onc_eea/onc:9/PKQ1.181021.001/V10.2.8.0.PFLEUXM:user/release-keys contains a pre-installed app with a package name of com.qualcomm.qti.callenhancement app (versionCode=28, versionName=9) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record telephone calls to external storage.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-610
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15743
Published: 2019-11-14
Description: The Sony Xperia Touch Android device with a build fingerprint of Sony/blanc_windy/blanc_windy:7.0/LOIRE-SMART-BLANC-1.0.0[PII_REDACTED]/1:user/dev-keys contains a pre-installed app with a package name of com.sonymobile.android.maintenancetool.testmic app (versionCode=24, versionName=7.0) that allows unauthorized microphone audio recording via a confused deputy attack. This capability can be accessed by any app co-located on the device. This app allows a third-party app to use its open interface to record audio to external storage.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-610
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15744
Published: 2019-11-14
Description: The Sony Xperia Xperia XZs Android device with a build fingerprint of Sony/keyaki_softbank/keyaki_softbank:7.1.1/TONE3-3.0.0-SOFTBANK[PII_REDACTED]/1:user/dev-keys contains a pre-installed app with a package name of jp.softbank.mb.tdrl app (versionCode=1413005, versionName=1.3.0) that allows unauthorized wireless settings modification via a confused deputy attack. This capability can be accessed by any app co-located on the device.
CVSS Score: 3.3 (LOW)
CWE: CWE-610
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-16110
Published: 2019-11-14
Description: The network protocol of Blade Shadow though 2.13.3 allows remote attackers to take control of a Shadow instance and execute arbitrary code by only knowing the victim's IP address, because packet data can be injected into the unencrypted UDP packet stream.
CVSS Score: 8.1 (HIGH)
References: https://sigint.sh/#/cve-2019-16110; https://sigint.sh/#/cve-2019-16110
CVE: CVE-2013-3073
Published: 2019-11-14
Description: A Symlink Traversal vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://kb.netgear.com/24413/WNDR3700v4-Firmware-Version-1-0-1-52-Except-China-and-Russia-Only; https://vuldb.com/?id.8471; https://www.ise.io/casestudies/exploiting-soho-routers/
CVE: CVE-2013-3070
Published: 2019-11-14
Description: An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface, which discloses the PSK of the wireless LAN.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://kb.netgear.com/24413/WNDR3700v4-Firmware-Version-1-0-1-52-Except-China-and-Russia-Only; https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/soho_service_hacks/
CVE: CVE-2013-3072
Published: 2019-11-14
Description: An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.cgi?/hdd_usr_setup.htm that when visited by any user, authenticated or not, causes the router to no longer require a password to access the web administration portal.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://kb.netgear.com/23728/WNDR4700-Firmware-Version-1-0-0-52; https://www.ise.io/casestudies/exploiting-soho-routers/; https://www.ise.io/research/studies-and-papers/netgear_wndr4700/
CVE: CVE-2013-4109
Published: 2019-11-14
Description: An unspecified cross-site scripting (XSS) vulnerability exists in Cryptocat Message Handling 1.1.165.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://tobtu.com/decryptocat.php; https://vuldb.com/es/?id.9445; https://www.openwall.com/lists/oss-security/2013/07/10/15
CVE: CVE-2019-0139
Published: 2019-11-14
Description: Insufficient access control in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow a privileged user to potentially enable an escalation of privilege, denial of service, or information disclosure via local access.
CVSS Score: 6.7 (MEDIUM)
References: https://support.f5.com/csp/article/K08441753?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://support.f5.com/csp/article/K08441753?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-0140
Published: 2019-11-14
Description: Buffer overflow in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an unauthenticated user to potentially enable an escalation of privilege via an adjacent access.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0142
Published: 2019-11-14
Description: Insufficient access control in ilp60x64.sys driver for Intel(R) Ethernet 700 Series Controllers before version 1.33.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 8.2 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0143
Published: 2019-11-14
Description: Unhandled exception in Kernel-mode drivers for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-755
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0144
Published: 2019-11-14
Description: Unhandled exception in firmware for Intel(R) Ethernet 700 Series Controllers before version 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0145
Published: 2019-11-14
Description: Buffer overflow in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable an escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0146
Published: 2019-11-14
Description: Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0147
Published: 2019-11-14
Description: Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0148
Published: 2019-11-14
Description: Resource leak in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-772
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0149
Published: 2019-11-14
Description: Insufficient input validation in i40e driver for Intel(R) Ethernet 700 Series Controllers versions before 2.8.43 may allow an authenticated user to potentially enable a denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0150
Published: 2019-11-14
Description: Insufficient access control in firmware Intel(R) Ethernet 700 Series Controllers versions before 7.0 may allow a privileged user to potentially enable a denial of service via local access.
CVSS Score: 5.1 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00255.html
CVE: CVE-2019-0154
Published: 2019-11-14
Description: Insufficient access control in subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 and E-2100 Processor Families may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
References: http://packetstormsecurity.com/files/155375/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://access.redhat.com/errata/RHSA-2020:0204; https://seclists.org/bugtraq/2019/Nov/26
CVE: CVE-2019-0155
Published: 2019-11-14
Description: Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor J, N, Silver and Gold Series; Intel(R) Celeron(R) Processor J, N, G3900 and G4900 Series; Intel(R) Atom(R) Processor A and E3900 Series; Intel(R) Xeon(R) Processor E3-1500 v5 and v6, E-2100 and E-2200 Processor Families; Intel(R) Graphics Driver for Windows before 26.20.100.6813 (DCH) or 26.20.100.6812 and before 21.20.x.5077 (aka15.45.5077), i915 Linux Driver for Intel(R) Processor Graphics before versions 5.4-rc7, 5.3.11, 4.19.84, 4.14.154, 4.9.201, 4.4.201 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: http://packetstormsecurity.com/files/155375/Slackware-Security-Advisory-Slackware-14.2-kernel-Updates.html; https://access.redhat.com/errata/RHSA-2019:3841; https://access.redhat.com/errata/RHSA-2019:3887
CVE: CVE-2019-0185
Published: 2019-11-14
Description: Insufficient access control in protected memory subsystem for SMM for 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor families; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 families; Intel(R) Xeon(R) E-2100 and E-2200 Processor families with Intel(R) Processor Graphics may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://support.f5.com/csp/article/K51535953?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00254.html; https://support.f5.com/csp/article/K51535953?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-11112
Published: 2019-11-14
Description: Memory corruption in Kernel Mode Driver in Intel(R) Graphics Driver before 26.20.100.6813 (DCH) or 26.20.100.6812 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-11135
Published: 2019-11-14
Description: TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00046.html; http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00042.html
CVE: CVE-2019-11139
Published: 2019-11-14
Description: Improper conditions check in the voltage modulation interface for some Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-754
References: http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00046.html; https://lists.debian.org/debian-lts-announce/2019/12/msg00035.html
CVE: CVE-2019-18937
Published: 2019-11-14
Description: eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script, which executes TCL script content from an HTTP POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://psytester.github.io/CVE-2019-18937/; https://psytester.github.io/CVE-2019-18937/
CVE: CVE-2019-18938
Published: 2019-11-14
Description: eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://psytester.github.io/CVE-2019-18938/; https://psytester.github.io/CVE-2019-18938/
CVE: CVE-2019-18939
Published: 2019-11-14
Description: eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts, which execute TCL script content from an HTTP POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306
References: https://psytester.github.io/CVE-2019-18939/; https://psytester.github.io/CVE-2019-18939/
CVE: CVE-2013-4106
Published: 2019-11-14
Description: A Cross-site scripting (XSS) vulnerability exists in Conversation Overview Nickname in Cryptocat before 2.0.22.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://tobtu.com/decryptocat.php; https://vuldb.com/pl/?id.9433; https://www.openwall.com/lists/oss-security/2013/07/10/15
CVE: CVE-2013-4108
Published: 2019-11-14
Description: Multiple unspecified vulnerabilities in Cryptocat Project Cryptocat 2.0.18 have unknown impact and attack vectors.
CVSS Score: 9.8 (CRITICAL)
References: https://tobtu.com/decryptocat.php; https://www.openwall.com/lists/oss-security/2013/07/10/15; https://tobtu.com/decryptocat.php
CVE: CVE-2018-12207
Published: 2019-11-14
Description: Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an authenticated user to potentially enable denial of service of the host system via local access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00042.html; https://access.redhat.com/errata/RHSA-2019:3916; https://access.redhat.com/errata/RHSA-2019:3936
CVE: CVE-2019-0117
Published: 2019-11-14
Description: Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th, 7th, 8th, 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families; Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
References: https://support.f5.com/csp/article/K73837233?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00219.html; https://support.f5.com/csp/article/K73837233?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-0123
Published: 2019-11-14
Description: Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting SGX, may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://support.f5.com/csp/article/K81556107?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00220.html; https://support.f5.com/csp/article/K81556107?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-0124
Published: 2019-11-14
Description: Insufficient memory protection in Intel(R) 6th Generation Core Processors and greater, supporting TXT, may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
References: https://support.f5.com/csp/article/K81556107?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00220.html; https://support.f5.com/csp/article/K81556107?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-0151
Published: 2019-11-14
Description: Insufficient memory protection in Intel(R) TXT for certain Intel(R) Core Processors and Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-398519.pdf; https://support.f5.com/csp/article/K34425791?utm_source=f5support&amp%3Butm_medium=RSS; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03971en_us
CVE: CVE-2019-0152
Published: 2019-11-14
Description: Insufficient memory protection in System Management Mode (SMM) and Intel(R) TXT for certain Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: https://cert-portal.siemens.com/productcert/pdf/ssa-398519.pdf; https://support.f5.com/csp/article/K34425791?utm_source=f5support&amp%3Butm_medium=RSS; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03971en_us
CVE: CVE-2019-0184
Published: 2019-11-14
Description: Insufficient access control in protected memory subsystem for Intel(R) TXT for 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5 and v6 Families; Intel(R) Xeon(R) E-2100 and E-2200 Processor Families with Intel(R) Processor Graphics and Intel(R) TXT may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
References: https://support.f5.com/csp/article/K41556648?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00164.html; https://support.f5.com/csp/article/K41556648?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-11089
Published: 2019-11-14
Description: Insufficient input validation in Kernel Mode module for Intel(R) Graphics Driver before version 25.20.100.6519 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-11111
Published: 2019-11-14
Description: Pointer corruption in the Unified Shader Compiler in Intel(R) Graphics Drivers before 10.18.14.5074 (aka 15.36.x.5074) may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-11113
Published: 2019-11-14
Description: Buffer overflow in Kernel Mode module for Intel(R) Graphics Driver before version 25.20.100.6618 (DCH) or 21.20.x.5077 (aka15.45.5077) may allow a privileged user to potentially enable information disclosure via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-119
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-14574
Published: 2019-11-14
Description: Out of bounds read in a subsystem for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-14590
Published: 2019-11-14
Description: Improper access control in the API for the Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable information disclosure via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-14591
Published: 2019-11-14
Description: Improper input validation in the API for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable denial of service via local access.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00242.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2019-14678
Published: 2019-11-14
Description: SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-611
References: http://support.sas.com/kb/64/719.html; https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-14678-Unsafe%20XML%20Parsing-SAS%20XML%20Mapper; http://support.sas.com/kb/64/719.html