deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-8634
Published: 2018-12-12
Description: A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory, aka "Microsoft Text-To-Speech Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/106078; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8634; http://www.securityfocus.com/bid/106078
CVE: CVE-2018-8635
Published: 2018-12-12
Description: An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an affected SharePoint server, aka "Microsoft SharePoint Server Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft SharePoint.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/106121; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8635; http://www.securityfocus.com/bid/106121
CVE: CVE-2018-8636
Published: 2018-12-12
Description: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel. This CVE ID is unique from CVE-2018-8597.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/106101; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8636; http://www.securityfocus.com/bid/106101
CVE: CVE-2018-8637
Published: 2018-12-12
Description: An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass, aka "Win32k Information Disclosure Vulnerability." This affects Windows 10 Servers, Windows 10, Windows Server 2019.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106095; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8637; http://www.securityfocus.com/bid/106095
CVE: CVE-2018-8638
Published: 2018-12-12
Description: An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulnerability." This affects Windows 10, Windows Server 2019.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106089; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8638; http://www.securityfocus.com/bid/106089
CVE: CVE-2018-8639
Published: 2018-12-12
Description: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404, CWE-404
References: http://www.securityfocus.com/bid/106093; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639; http://www.securityfocus.com/bid/106093
CVE: CVE-2018-8641
Published: 2018-12-12
Description: An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8639.
CVSS Score: 7.8 (HIGH)
CWE: CWE-404
References: http://www.securityfocus.com/bid/106090; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8641; http://www.securityfocus.com/bid/106090
CVE: CVE-2018-8643
Published: 2018-12-12
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://www.securityfocus.com/bid/106117; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8643; http://www.securityfocus.com/bid/106117
CVE: CVE-2018-8649
Published: 2018-12-12
Description: A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." This affects Windows 10, Windows Server 2019.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106091; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8649; http://www.securityfocus.com/bid/106091
CVE: CVE-2018-8651
Published: 2018-12-12
Description: A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106077; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8651; http://www.securityfocus.com/bid/106077
CVE: CVE-2018-8652
Published: 2018-12-12
Description: A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106155; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8652; http://www.securityfocus.com/bid/106155
CVE: CVE-2018-18397
Published: 2018-12-12
Description: The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data into holes in a tmpfs file (if the user has read-only access to that file, and that file contains holes), related to fs/userfaultfd.c and mm/userfaultfd.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=29ec90660d68bbdd69507c1c8b4e33aa299278b1; https://access.redhat.com/errata/RHBA-2019:0327; https://access.redhat.com/errata/RHSA-2019:0163
CVE: CVE-2018-20094
Published: 2018-12-12
Description: An issue was discovered in XXL-CONF 1.6.0. There is a path traversal vulnerability via ../ in the keys parameter that can download any configuration file, related to ConfController.java and PropUtil.java.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/xuxueli/xxl-conf/issues/61; https://github.com/xuxueli/xxl-conf/issues/61
CVE: CVE-2018-20095
Published: 2018-12-12
Description: An issue was discovered in EnsureCapacity in Core/Ap4Array.h in Bento4 1.5.1-627. Crafted MP4 input triggers an attempt at excessive memory allocation, as demonstrated by mp42hls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://github.com/axiomatic-systems/Bento4/issues/341; https://github.com/axiomatic-systems/Bento4/issues/341
CVE: CVE-2018-20096
Published: 2018-12-12
Description: There is a heap-based buffer over-read in the Exiv2::tEXtToDataBuf function of pngimage.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/590; https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
CVE: CVE-2018-20097
Published: 2018-12-12
Description: There is a SEGV in Exiv2::Internal::TiffParserWorker::findPrimaryGroups of tiffimage_int.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/590; https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
CVE: CVE-2018-20098
Published: 2018-12-12
Description: There is a heap-based buffer over-read in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/590; https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
CVE: CVE-2018-20099
Published: 2018-12-12
Description: There is an infinite loop in Exiv2::Jp2Image::encodeJp2Header of jp2image.cpp in Exiv2 0.27-RC3. A crafted input will lead to a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-835
References: https://access.redhat.com/errata/RHSA-2019:2101; https://github.com/Exiv2/exiv2/issues/590; https://github.com/TeamSeri0us/pocs/tree/master/exiv2/20181206
CVE: CVE-2018-16867
Published: 2018-12-12
Description: A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.
CVSS Score: 7.8 (HIGH)
CWE: CWE-362, CWE-362
References: http://www.securityfocus.com/bid/106195; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16867; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/
CVE: CVE-2018-15328
Published: 2018-12-12
Description: On BIG-IP 14.0.x, 13.x, 12.x, and 11.x, Enterprise Manager 3.1.1, BIG-IQ 6.x, 5.x, and 4.x, and iWorkflow 2.x, the passphrases for SNMPv3 users and trap destinations that are used for authentication and privacy are not handled by the BIG-IP system Secure Vault feature; they are written in the clear to the various configuration files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/106258; https://support.f5.com/csp/article/K42027747; http://www.securityfocus.com/bid/106258
CVE: CVE-2018-17949
Published: 2018-12-12
Description: Cross site scripting vulnerability in iManager prior to 3.1 SP2.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netiq.com/documentation/imanager-31/imanager312_releasenotes/data/imanager312_releasenotes.html; https://www.netiq.com/documentation/imanager-31/imanager312_releasenotes/data/imanager312_releasenotes.html
CVE: CVE-2018-17950
Published: 2018-12-12
Description: Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2
CVSS Score: 7.5 (HIGH)
CWE: CWE-863
References: https://www.netiq.com/documentation/edirectory-91/edirectory912_releasenotes/data/edirectory912_releasenotes.html; https://www.netiq.com/documentation/edirectory-91/edirectory912_releasenotes/data/edirectory912_releasenotes.html
CVE: CVE-2018-17952
Published: 2018-12-12
Description: Cross site scripting vulnerability in eDirectory prior to 9.1 SP2
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.netiq.com/documentation/edirectory-91/edirectory912_releasenotes/data/edirectory912_releasenotes.html; https://www.netiq.com/documentation/edirectory-91/edirectory912_releasenotes/data/edirectory912_releasenotes.html
CVE: CVE-2018-8650
Published: 2018-12-12
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoint.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/106170; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8650; http://www.securityfocus.com/bid/106170
CVE: CVE-2018-11457
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). The integrated web server on port 4842/tcp of the affected products could allow a remote attacker to execute code with privileged permissions on the system by sending specially crafted network requests to port 4842/tcp. Please note that this vulnerability is only exploitable if port 4842/tcp is manually opened in the firewall configuration of network port X130. The security vulnerability could be exploited by an attacker with network access to the affected devices on port 4842/tcp. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the web server. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 8.1 (HIGH)
CWE: CWE-122
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11458
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). The integrated VNC server on port 5900/tcp of the affected products could allow a remote attacker to execute code with privileged permissions on the system by sending specially crafted network requests to port 5900/tcp. Please note that this vulnerability is only exploitable if port 5900/tcp is manually opened in the firewall configuration of network port X130. The security vulnerability could be exploited by an attacker with network access to the affected devices and port. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the VNC server. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 8.1 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11459
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A local attacker could modify a user-writeable configuration file so that after reboot or manual initiation the system reloads the modified configuration file and attacker-controlled code is executed with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected system. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11460
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A local attacker with elevated user privileges (manufact) could modify a CRAMFS archive so that after reboot the system loads the modified CRAMFS file and attacker-controlled code is executed with root privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires elevated user privileges (manufact) but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.8 (HIGH)
CWE: CWE-693
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11461
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A local attacker with user privileges could use the service command application for privilege escalation to an elevated user but not root. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11462
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). By sending a specially crafted authentication request to the affected systems a remote attacker could escalate his privileges to an elevated user account but not to root. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11463
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A buffer overflow in the service command application could allow a local attacker to execute code with elevated privileges. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-119
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11464
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). The integrated VNC server on port 5900/tcp of the affected products could allow a remote attacker to cause a Denial-of-Service condition of the VNC server. Please note that this vulnerability is only exploitable if port 5900/tcp is manually opened in the firewall configuration of network port X130. The security vulnerability could be exploited by an attacker with network access to the affected devices and port. Successful exploitation requires no privileges and no user interaction. The vulnerability could allow an attacker to compromise availability of the VNC server. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 3.7 (LOW)
CWE: CWE-248
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11465
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). A local attacker could use ioctl calls to do out of bounds reads, arbitrary writes, or execute code in kernel mode. The security vulnerability could be exploited by an attacker with local access to the affected systems. Successful exploitation requires user privileges but no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 7.8 (HIGH)
CWE: CWE-248, CWE-125
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-11466
Published: 2018-12-12
Description: A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions), SINUMERIK 828D V4.7 (All versions < V4.7 SP6 HF1), SINUMERIK 840D sl V4.7 (All versions < V4.7 SP6 HF5), SINUMERIK 840D sl V4.8 (All versions < V4.8 SP3). Specially crafted network packets sent to port 102/tcp (ISO-TSAP) could allow a remote attacker to either cause a Denial-of-Service condition of the integrated software firewall or allow to execute code in the context of the software firewall. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 102/tcp. Successful exploitation requires no user privileges and no user interaction. The vulnerability could allow an attacker to compromise confidentiality, integrity and availability of the system. At the time of advisory publication no public exploitation of this security vulnerability was known
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-248
References: http://www.securityfocus.com/bid/106185; https://cert-portal.siemens.com/productcert/pdf/ssa-170881.pdf; http://www.securityfocus.com/bid/106185
CVE: CVE-2018-13816
Published: 2018-12-12
Description: A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, although configured. Successful exploitation requires an attacker to be able to send packets to port 102/tcp of the affected device. No user interaction and no user privileges are required to exploit the vulnerability. At the time of advisory publication no public exploitation of this vulnerability was known.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-284, CWE-287
References: http://www.securityfocus.com/bid/106194; https://cert-portal.siemens.com/productcert/pdf/ssa-982399.pdf; http://www.securityfocus.com/bid/106194