deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1723
Published: 2019-03-13
Description: A vulnerability in the Cisco Common Services Platform Collector (CSPC) could allow an unauthenticated, remote attacker to access an affected device by using an account that has a default, static password. This account does not have administrator privileges. The vulnerability exists because the affected software has a user account with a default, static password. An attacker could exploit this vulnerability by remotely connecting to the affected system using this account. A successful exploit could allow the attacker to log in to the CSPC using the default account. For Cisco CSPC 2.7.x, Cisco fixed this vulnerability in Release 2.7.4.6. For Cisco CSPC 2.8.x, Cisco fixed this vulnerability in Release 2.8.1.2.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264, CWE-798
References: http://www.securityfocus.com/bid/107405; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190313-cspcscv; https://www.info-sec.ca/advisories/Cisco-Collector.html
CVE: CVE-2019-3711
Published: 2019-03-13
Description: RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may be able to obtain the value of a domain password that another Operations Console administrator had set previously and use it for attacks.
CVSS Score: 5.8 (MEDIUM)
References: http://www.securityfocus.com/bid/107210; https://seclists.org/fulldisclosure/2019/Mar/5; http://www.securityfocus.com/bid/107210
CVE: CVE-2019-3715
Published: 2019-03-13
Description: RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/107443; https://seclists.org/fulldisclosure/2019/Mar/19; http://www.securityfocus.com/bid/107443
CVE: CVE-2019-3716
Published: 2019-03-13
Description: RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed password to use it in further attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/107406; https://seclists.org/fulldisclosure/2019/Mar/19; http://www.securityfocus.com/bid/107406
CVE: CVE-2019-3785
Published: 2019-03-13
Description: Cloud Foundry Cloud Controller, versions prior to 1.78.0, contain an endpoint with improper authorization. A remote authenticated malicious user with read permissions can request package information and receive a signed bit-service url that grants the user write permissions to the bit-service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285, CWE-269
References: http://www.securityfocus.com/bid/107514; https://www.cloudfoundry.org/blog/cve-2019-3785; http://www.securityfocus.com/bid/107514
CVE: CVE-2018-20800
Published: 2019-03-13
Description: An issue was discovered in Open Ticket Request System (OTRS) 5.0.31 and 6.0.13. Users updating to 6.0.13 (also patchlevel updates) or 5.0.31 (only major updates) will experience data loss in their agent preferences table.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://community.otrs.com/security-advisory-2018-10-security-update-for-otrs-framework; https://community.otrs.com/security-advisory-2018-10-security-update-for-otrs-framework
CVE: CVE-2019-6596
Published: 2019-03-13
Description: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.1, 12.1.0-12.1.3.6, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when processing fragmented ClientHello messages in a DTLS session TMM may corrupt memory eventually leading to a crash. Only systems offering DTLS connections via APM are impacted.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/107403; https://support.f5.com/csp/article/K97241515; http://www.securityfocus.com/bid/107403
CVE: CVE-2019-6597
Published: 2019-03-13
Description: In BIG-IP 13.0.0-13.1.1.1, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, when authenticated administrative users run commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.
CVSS Score: 7.2 (HIGH)
References: https://support.f5.com/csp/article/K29280193; https://support.f5.com/csp/article/K29280193
CVE: CVE-2019-6598
Published: 2019-03-13
Description: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.0.7, 12.1.0-12.1.3.5, 11.6.1-11.6.3.2, or 11.5.1-11.5.8 or Enterprise Manager 3.1.1, malformed requests to the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, may lead to disruption of TMUI services. This attack requires an authenticated user with any role (other than the No Access role). The No Access user role cannot login and does not have the access level to perform the attack.
CVSS Score: 4.3 (MEDIUM)
References: https://support.f5.com/csp/article/K44603900; https://support.f5.com/csp/article/K44603900
CVE: CVE-2019-6599
Published: 2019-03-13
Description: In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting (XSS) attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107420; https://support.f5.com/csp/article/K46401178; http://www.securityfocus.com/bid/107420
CVE: CVE-2019-6600
Published: 2019-03-13
Description: In BIG-IP 14.0.0-14.0.0.2, 13.0.0-13.1.1.3, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, when remote authentication is enabled for administrative users and all external users are granted the "guest" role, unsanitized values can be reflected to the client via the login page. This can lead to a cross-site scripting attack against unauthenticated clients.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/107470; https://support.f5.com/csp/article/K23734425; http://www.securityfocus.com/bid/107470
CVE: CVE-2019-6601
Published: 2019-03-13
Description: In BIG-IP 13.0.0, 12.1.0-12.1.3.7, 11.6.1-11.6.3.2, or 11.5.1-11.5.8, the Application Acceleration Manager (AAM) wamd process used in processing of images and PDFs fails to drop group permissions when executing helper scripts.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: http://www.securityfocus.com/bid/107444; https://support.f5.com/csp/article/K25359902; http://www.securityfocus.com/bid/107444
CVE: CVE-2019-9751
Published: 2019-03-13
Description: An issue was discovered in Open Ticket Request System (OTRS) 6.x before 6.0.17 and 7.x before 7.0.5. An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS. This is related to Kernel/Output/Template/Document.pm.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://community.otrs.com/security-advisory-2019-02-security-update-for-otrs-framework; https://community.otrs.com/security-advisory-2019-02-security-update-for-otrs-framework
CVE: CVE-2019-9752
Published: 2019-03-13
Description: An issue was discovered in Open Ticket Request System (OTRS) 5.x before 5.0.34, 6.x before 6.0.16, and 7.x before 7.0.4. An attacker who is logged into OTRS as an agent or a customer user may upload a carefully crafted resource in order to cause execution of JavaScript in the context of OTRS. This is related to Content-type mishandling in Kernel/Modules/PictureUpload.pm.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html; http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html
CVE: CVE-2019-9754
Published: 2019-03-13
Description: An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. Compiling a crafted source file leads to an 1 byte out of bounds write in the end_macro function in tccpp.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://lists.nongnu.org/archive/html/tinycc-devel/2019-03/msg00038.html; https://lists.nongnu.org/archive/html/tinycc-devel/2019-03/msg00038.html
CVE: CVE-2019-9760
Published: 2019-03-14
Description: FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-controlled machine that sends crafted responses. Long responses can also crash the FTP client with memory corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/w4fz5uck5/FTPGetter/blob/master/xpl.py; https://www.exploit-db.com/exploits/46543/; https://github.com/w4fz5uck5/FTPGetter/blob/master/xpl.py
CVE: CVE-2019-9761
Published: 2019-03-14
Description: An XXE issue was discovered in PHPSHE 1.7, which can be used to read any file in the system or scan the internal network without authentication. This occurs because of the call to wechat_getxml in include/plugin/payment/wechat/notify_url.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://gitee.com/koyshe/phpshe/issues/ITC0C; https://gitee.com/koyshe/phpshe/issues/ITC0C
CVE: CVE-2019-9762
Published: 2019-03-14
Description: A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gitee.com/koyshe/phpshe/issues/ITC0C; https://gitee.com/koyshe/phpshe/issues/ITC0C
CVE: CVE-2019-9765
Published: 2019-03-14
Description: In Blog_mini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails() function, related to app/templates/_article_comments.html.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/xpleaf/Blog_mini/issues/43; https://github.com/xpleaf/Blog_mini/issues/43
CVE: CVE-2019-9766
Published: 2019-03-14
Description: Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .mp3 file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.exploit-db.com/exploits/45403; https://www.exploit-db.com/exploits/45403
CVE: CVE-2019-9767
Published: 2019-03-14
Description: Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .wma file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/160157/Free-MP3-CD-Ripper-2.8-Buffer-Overflow.html; https://packetstormsecurity.com/files/149371/Free-MP3-CD-Ripper-2.6-Local-Buffer-Overflow.html; https://www.exploit-db.com/exploits/45412
CVE: CVE-2019-9768
Published: 2019-03-14
Description: Thinkst Canarytokens through commit hash 4e89ee0 (2019-03-01) relies on limited variation in size, metadata, and timestamp, which makes it easier for attackers to estimate whether a Word document contains a token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://packetstormsecurity.com/files/152182/Canarytokens-2019-03-01-Detection-Bypass.html; https://github.com/thinkst/canarytokens/issues/35; https://www.exploit-db.com/exploits/46589/
CVE: CVE-2019-9769
Published: 2019-03-14
Description: PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.exploit-db.com/exploits/46531; https://www.exploit-db.com/exploits/46531
CVE: CVE-2019-9770
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the y dimension.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9771
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function bit_convert_TU at bits.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9772
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LEADER at dwg.spec.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9773
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer overflow in the function dwg_decode_eed_data at decode.c for the z dimension.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9774
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function bit_read_B at bits.c.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9775
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is an out-of-bounds read in the function dwg_dxf_BLOCK_CONTROL at dwg.spec.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9776
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (later than CVE-2019-9779).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9777
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dxf_header_write at header_variables_dxf.spec.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9778
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a heap-based buffer over-read in the function dwg_dxf_LTYPE at dwg.spec.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9779
Published: 2019-03-14
Description: An issue was discovered in GNU LibreDWG 0.7 and 0.7.1645. There is a NULL pointer dereference in the function dwg_dxf_LTYPE at dwg.spec (earlier than CVE-2019-9776).
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00033.html; http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00045.html; http://www.securityfocus.com/bid/107447
CVE: CVE-2019-9785
Published: 2019-03-14
Description: gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require('child_process').execFile substring in the onerror attribute of an IMG element.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/CCCCCrash/POCs/tree/master/Web/gitnote; https://github.com/zhaopengme/gitnote/issues/209; https://github.com/CCCCCrash/POCs/tree/master/Web/gitnote
CVE: CVE-2018-20801
Published: 2019-03-14
Description: In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.
CVSS Score: 7.5 (HIGH)
CWE: CWE-185
References: https://github.com/highcharts/highcharts/commit/7c547e1e0f5e4379f94396efd559a566668c0dfa; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://snyk.io/vuln/npm:highcharts:20180225
CVE: CVE-2019-9787
Published: 2019-03-14
Description: WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS. The XSS results in administrative access, which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/107411; https://blog.ripstech.com/2019/wordpress-csrf-to-rce/; https://github.com/WordPress/WordPress/commit/0292de60ec78c5a[PII_REDACTED]9403654fe4d080b
CVE: CVE-2018-12185
Published: 2019-03-14
Description: Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially execute arbitrary code via physical access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12187
Published: 2019-03-14
Description: Insufficient input validation in Intel(R) Active Management Technology (Intel(R) AMT) before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow an unauthenticated user to potentially cause a denial of service via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12188
Published: 2019-03-14
Description: Insufficient input validation in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before version 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially modify data via physical access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12189
Published: 2019-03-14
Description: Unhandled exception in Content Protection subsystem in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel TXE before 3.1.60 or 4.0.10 may allow privileged user to potentially modify data via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-754
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12190
Published: 2019-03-14
Description: Insufficient input validation in Intel(r) CSME subsystem before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 or Intel(r) TXE before 3.1.60 or 4.0.10 may allow a privileged user to potentially enable an escalation of privilege via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12191
Published: 2019-03-14
Description: Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or Intel(R) TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrary code via physical access.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03914en_us; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html
CVE: CVE-2018-12192
Published: 2019-03-14
Description: Logic bug in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before version SPS_E5_04.00.04.393.0 may allow an unauthenticated user to potentially bypass MEBx authentication via physical access.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03914en_us; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html
CVE: CVE-2018-12196
Published: 2019-03-14
Description: Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary code via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12198
Published: 2019-03-14
Description: Insufficient input validation in Intel(R) Server Platform Services HECI subsystem before version SPS_E5_04.00.04.393.0 may allow privileged user to potentially cause a denial of service via local access.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03914en_us; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html
CVE: CVE-2018-12199
Published: 2019-03-14
Description: Buffer overflow in an OS component in Intel CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel TXE version before 3.1.60 or 4.0.10 may allow a privileged user to potentially execute arbitrary code via physical access.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-119
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-12200
Published: 2019-03-14
Description: Insufficient access control in Intel(R) Capability Licensing Service before version 1.50.638.1 may allow an unprivileged user to potentially escalate privileges via local access.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-732
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/