deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-17200
Published: 2019-09-11
Description: The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019
CVSS Score: 9.8 (CRITICAL)
References: https://lists.apache.org/thread.html/r034123f[PII_REDACTED]fd04c922afb22d2389de6e2faf3a083207202bc%40%3Ccommits.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/rf8651e75162819a267384f8a31c20884bc3a9a6707afbf75200cd98d%40%3Ccommits.ofbiz.apache.org%3E
CVE: CVE-2019-0189
Published: 2019-09-11
Description: The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: https://lists.apache.org/thread.html/7316b4fa811e1ec27604cda3c30560e7389fc6b8c91996c9640fabb8%40%3Cnotifications.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/986ed5f1a0e209f87ed4a2d348ae5735054f9188912bb2fed7a5543f%40%3Cnotifications.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/r11fd9562dbdfc0be95e40518cbef70ab2565129f6f542a870ab82c69%40%3Cnotifications.ofbiz.apache.org%3E
CVE: CVE-2019-10073
Published: 2019-09-11
Description: The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438, 1858543, 1860595 and 1860616
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/r8f01aab5dd92487c191599def3c950c643d7ad297c4db1d6722ea151%40%3Ccommits.ofbiz.apache.org%3E; https://lists.apache.org/thread.html/rfafb229c0d805c8f2bd232d28cd1297876faf5c953f1d7bcf76eef4f%40%3Ccommits.ofbiz.apache.org%3E; https://s.apache.org/w6edy
CVE: CVE-2019-10074
Published: 2019-09-11
Description: An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74, CWE-116
References: https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2%40%3Cnotifications.ofbiz.apache.org%3E; https://s.apache.org/r49vw; https://lists.apache.org/thread.html/a02aaa4c19dfd520807cf6b106b71aad0131a6543f7f60802ae71ec2%40%3Cnotifications.ofbiz.apache.org%3E
CVE: CVE-2019-13536
Published: 2019-09-11
Description: Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-19-253-01; https://www.us-cert.gov/ics/advisories/icsa-19-253-01
CVE: CVE-2019-13540
Published: 2019-09-11
Description: Delta Electronics TPEditor, Versions 1.94 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-19-253-01; https://www.us-cert.gov/ics/advisories/icsa-19-253-01
CVE: CVE-2019-13544
Published: 2019-09-11
Description: Delta Electronics TPEditor, Versions 1.94 and prior. Multiple out-of-bounds write vulnerabilities may be exploited by processing specially crafted project files, which may allow remote code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.us-cert.gov/ics/advisories/icsa-19-253-01; https://www.us-cert.gov/ics/advisories/icsa-19-253-01
CVE: CVE-2019-15302
Published: 2019-09-11
Description: The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text pad with editing rights for the URL) to corrupt it (i.e., cause data loss) via a trivial URL modification.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-404
References: https://github.com/xwiki-labs/cryptpad/commits/staging; https://github.com/xwiki-labs/cryptpad/releases/tag/3.0.0; https://github.com/xwiki-labs/cryptpad/commits/staging
CVE: CVE-2019-0787
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0788, CVE-2019-1290, CVE-2019-1291.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0787; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0787
CVE: CVE-2019-0788
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote Desktop Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0787, CVE-2019-1290, CVE-2019-1291.
CVSS Score: 8.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0788; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0788
CVE: CVE-2019-0928
Published: 2019-09-11
Description: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0928; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0928
CVE: CVE-2019-16247
Published: 2019-09-11
Description: Delta DCISoft 1.21 has a User Mode Write AV starting at CommLib!CCommLib::SetSerializeData+0x[PII_REDACTED]00001b.
CVSS Score: 7.8 (HIGH)
References: https://code610.blogspot.com/2019/09/crashing-dcisoft-121.html; https://code610.blogspot.com/2019/09/crashing-dcisoft-121.html
CVE: CVE-2019-1138
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1217, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1138; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1138
CVE: CVE-2019-1142
Published: 2019-09-11
Description: An elevation of privilege vulnerability exists when the .NET Framework common language runtime (CLR) allows file creation in arbitrary locations, aka '.NET Framework Elevation of Privilege Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1142; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1142
CVE: CVE-2019-1208
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1236.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1208; https://www.zerodayinitiative.com/advisories/ZDI-19-831/; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1208
CVE: CVE-2019-1209
Published: 2019-09-11
Description: An information disclosure vulnerability exists in Lync 2013, aka 'Lync 2013 Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1209; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1209
CVE: CVE-2019-1214
Published: 2019-09-11
Description: An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aka 'Windows Common Log File System Driver Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1214; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1214; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1214
CVE: CVE-2019-1215
Published: 2019-09-11
Description: An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1253, CVE-2019-1278, CVE-2019-1303.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1215; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1215; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1215
CVE: CVE-2019-1216
Published: 2019-09-11
Description: An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1216; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1216
CVE: CVE-2019-1217
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1217; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1217
CVE: CVE-2019-1219
Published: 2019-09-11
Description: An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Transaction Manager Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1219; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1219
CVE: CVE-2019-1220
Published: 2019-09-11
Description: A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs, aka 'Microsoft Browser Security Feature Bypass Vulnerability'.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-425
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1220; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1220
CVE: CVE-2019-1221
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1221; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1221
CVE: CVE-2019-1231
Published: 2019-09-11
Description: An information disclosure vulnerability exists in the way Rome SDK handles server SSL/TLS certificate validation, aka 'Rome SDK Information Disclosure Vulnerability'.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1231; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1231
CVE: CVE-2019-1232
Published: 2019-09-11
Description: An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations, aka 'Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1232; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1232
CVE: CVE-2019-1233
Published: 2019-09-11
Description: A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1233; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1233
CVE: CVE-2019-1235
Published: 2019-09-11
Description: An elevation of privilege vulnerability exists in Windows Text Service Framework (TSF) when the TSF server process does not validate the source of input or commands it receives, aka 'Windows Text Service Framework Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
CWE: CWE-346
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1235; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1235
CVE: CVE-2019-1236
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1208.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1236; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1236
CVE: CVE-2019-1237
Published: 2019-09-11
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1298, CVE-2019-1300.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1237; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1237
CVE: CVE-2019-1240
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1241, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1240; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1240
CVE: CVE-2019-1241
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1241; https://www.oracle.com/security-alerts/cpuApr2021.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1241
CVE: CVE-2019-1242
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1242; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1242
CVE: CVE-2019-1243
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1243; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1243
CVE: CVE-2019-1244
Published: 2019-09-11
Description: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1245, CVE-2019-1251.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1244; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1244
CVE: CVE-2019-1245
Published: 2019-09-11
Description: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1244, CVE-2019-1251.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1245; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1245
CVE: CVE-2019-1246
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1243, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1246; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1246
CVE: CVE-2019-1247
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1247; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1247
CVE: CVE-2019-1248
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1249, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1248; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1248
CVE: CVE-2019-1249
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1250.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1249; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1249
CVE: CVE-2019-1250
Published: 2019-09-11
Description: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1250; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1250
CVE: CVE-2019-1251
Published: 2019-09-11
Description: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1244, CVE-2019-1245.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1251; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1251
CVE: CVE-2019-1252
Published: 2019-09-11
Description: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1286.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1252; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1252
CVE: CVE-2019-1253
Published: 2019-09-11
Description: An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker would first have to gain execution on the victim system, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1215, CVE-2019-1278, CVE-2019-1303.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://packetstormsecurity.com/files/154488/AppXSvc-17763.1.amd64fre.rs5_release[PII_REDACTED]-Privilege-Escalation.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1253; http://packetstormsecurity.com/files/154488/AppXSvc-17763.1.amd64fre.rs5_release[PII_REDACTED]-Privilege-Escalation.html
CVE: CVE-2019-1254
Published: 2019-09-11
Description: An information disclosure vulnerability exists when Windows Hyper-V writes uninitialized memory to disk, aka 'Windows Hyper-V Information Disclosure Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-908
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1254; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1254