deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-5553
Published: 2018-07-10
Description: The Crestron Console service running on DGE-100, DM-DGE-200-C, and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://blog.rapid7.com/2018/06/12/r7-2018-15-cve-2018-5553-crestron-dge-100-console-command-injection-fixed/; https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE%C2%AD-2018%C2%AD-5553; https://blog.rapid7.com/2018/06/12/r7-2018-15-cve-2018-5553-crestron-dge-100-console-command-injection-fixed/
CVE: CVE-2018-1331
Published: 2018-07-10
Description: In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user.
CVSS Score: 8.8 (HIGH)
References: http://storm.apache.org/2018/06/04/storm113-released.html; http://storm.apache.org/2018/06/04/storm122-released.html; http://www.openwall.com/lists/oss-security/2018/07/10/4
CVE: CVE-2018-10889
Published: 2018-07-10
Description: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: http://www.securityfocus.com/bid/104733; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10889; https://moodle.org/mod/forum/discuss.php?d=373369
CVE: CVE-2018-10890
Published: 2018-07-10
Description: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/104738; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890; https://moodle.org/mod/forum/discuss.php?d=373370
CVE: CVE-2018-10891
Published: 2018-07-10
Description: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.
CVSS Score: 7.3 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104739; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10891; https://moodle.org/mod/forum/discuss.php?d=373371
CVE: CVE-2018-12461
Published: 2018-07-10
Description: Fixed issues with NetIQ eDirectory prior to 9.1.1 when checking certificate revocation.
CVSS Score: 3.5 (LOW)
CWE: CWE-295
References: https://www.netiq.com/support/kb/doc.php?id=7016794; https://www.netiq.com/support/kb/doc.php?id=7016794
CVE: CVE-2018-13843
Published: 2018-07-10
Description: An issue has been found in HTSlib 1.8. It is a memory leak in bgzf_getline in bgzf.c. NOTE: the software maintainer's position is that the "failure to free memory" can be fixed in applications that use the HTSlib library (such as test/test_bgzf.c in the original report) and is not a library issue
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://github.com/samtools/htslib/issues/731#issue-339662537; https://github.com/samtools/htslib/issues/731#issue-339662537
CVE: CVE-2018-13844
Published: 2018-07-10
Description: An issue has been found in HTSlib 1.8. It is a memory leak in fai_read in faidx.c. NOTE: This has been disputed with the assertion that this vulnerability exists in the test harness and HTSlib users would be aware of the need to destruct this object returned by fai_load() in their own code
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://github.com/samtools/htslib/issues/731#issuecomment-403675330; https://github.com/samtools/htslib/issues/731#issuecomment-403675330
CVE: CVE-2018-13845
Published: 2018-07-10
Description: An issue has been found in HTSlib 1.8. It is a buffer over-read in sam_parse1 in sam.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/samtools/htslib/issues/731#issuecomment-403681105; https://github.com/samtools/htslib/issues/731#issuecomment-403681105
CVE: CVE-2018-13846
Published: 2018-07-10
Description: An issue has been found in Bento4 1.5.1-624. AP4_Mpeg2TsVideoSampleStream::WriteSample in Core/Ap4Mpeg2Ts.cpp has a heap-based buffer over-read after a call from Mp42Ts.cpp, a related issue to CVE-2018-14532.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/axiomatic-systems/Bento4/issues/282; https://github.com/axiomatic-systems/Bento4/issues/282
CVE: CVE-2018-13847
Published: 2018-07-10
Description: An issue has been found in Bento4 1.5.1-624. It is a SEGV in AP4_StcoAtom::AdjustChunkOffsets in Core/Ap4StcoAtom.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/axiomatic-systems/Bento4/issues/283; https://github.com/axiomatic-systems/Bento4/issues/283
CVE: CVE-2018-13848
Published: 2018-07-10
Description: An issue has been found in Bento4 1.5.1-624. It is a SEGV in AP4_StszAtom::GetSampleSize in Core/Ap4StszAtom.cpp.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://github.com/axiomatic-systems/Bento4/issues/285; https://github.com/axiomatic-systems/Bento4/issues/285
CVE: CVE-2018-13849
Published: 2018-07-10
Description: edit_requests.php in yTakkar Instagram-clone through 2018-04-23 has XSS via an onmouseover payload because of an inadequate XSS protection mechanism based on preg_replace.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://www.exploit-db.com/exploits/45003/; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-13850
Published: 2018-07-10
Description: The "Firebase Cloud Messaging (FCM) + Advance Admin Panel" component supporting Firebase Push Notification on iOS (through 2017-10-26) allows SQL injection via the /advance_push/public/login username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-2427
Published: 2018-07-10
Description: SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, and SAP Crystal Reports (version for Visual Studio .NET, Version 2010) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behaviour of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://www.securityfocus.com/bid/104715; https://launchpad.support.sap.com/#/notes/2620738; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2431
Published: 2018-07-10
Description: SAP BusinessObjects Business Intelligence Suite, versions 4.10 and 4.20, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104695; https://launchpad.support.sap.com/#/notes/2624762; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2432
Published: 2018-07-10
Description: SAP BusinessObjects Business Intelligence (BI Launchpad and Central Management Console) versions 4.10, 4.20 and 4.30 allow an attacker to include invalidated data in the HTTP response header sent to a Web user. Successful exploitation of this vulnerability may lead to advanced attacks, including: cross-site scripting and page hijacking.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104716; https://launchpad.support.sap.com/#/notes/2523290; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2433
Published: 2018-07-10
Description: SAP Gateway (SAP KERNEL 32 NUC, SAP KERNEL 32 Unicode, SAP KERNEL 64 NUC, SAP KERNEL 64 Unicode 7.21, 7.21EXT, 7.22 and 7.22EXT; SAP KERNEL 7.21, 7.22, 7.45, 7.49 and 7.53) allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 7.5 (HIGH)
References: https://launchpad.support.sap.com/#/notes/2597913; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000; https://launchpad.support.sap.com/#/notes/2597913
CVE: CVE-2018-2434
Published: 2018-07-10
Description: A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-345
References: http://www.securityfocus.com/bid/105088; https://launchpad.support.sap.com/#/notes/2633180; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2435
Published: 2018-07-10
Description: SAP NetWeaver Enterprise Portal from 7.0 to 7.02, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104706; https://launchpad.support.sap.com/#/notes/2643126; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2436
Published: 2018-07-10
Description: Executing transaction WRCK in SAP R/3 Enterprise Retail (EHP6) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: http://www.securityfocus.com/bid/104703; https://launchpad.support.sap.com/#/notes/2652578; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2437
Published: 2018-07-10
Description: The SAP Internet Graphics Service (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, allows an attacker to externally trigger IGS command executions which can lead to: disclosure of information and malicious file insertion or modification.
CVSS Score: 9.1 (CRITICAL)
References: http://www.securityfocus.com/bid/104705; https://launchpad.support.sap.com/#/notes/2644227; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2438
Published: 2018-07-10
Description: The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has several denial-of-service vulnerabilities that allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/104707; https://launchpad.support.sap.com/#/notes/2644238; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2439
Published: 2018-07-10
Description: The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for authenticity and validity) and under certain conditions, will process invalid requests. Several areas of the SAP Internet Graphics Server (IGS) did not require sufficient input validation. Namely, the SAP Internet Graphics Server (IGS) HTTP and RFC listener, SAP Internet Graphics Server (IGS) portwatcher when registering a portwatcher to the multiplexer and the SAP Internet Graphics Server (IGS) multiplexer had insufficient input validation and thus allowing a malformed data packet to cause a crash.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104708; https://launchpad.support.sap.com/#/notes/2644147; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000
CVE: CVE-2018-2440
Published: 2018-07-10
Description: Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sensitive information in the application logs.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://launchpad.support.sap.com/#/notes/2664767; https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000; https://launchpad.support.sap.com/#/notes/2664767
CVE: CVE-2018-10872
Published: 2018-07-10
Description: A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed. An unprivileged system user could use this flaw to crash the system kernel resulting in DoS. This CVE-2018-10872 was assigned due to regression of CVE-2018-8897 in Red Hat Enterprise Linux 6.10 GA kernel. No other versions are affected by this CVE.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-250, CWE-119
References: https://access.redhat.com/errata/RHSA-2018:2164; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10872; https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
CVE: CVE-2018-1116
Published: 2018-07-10
Description: A flaw was found in polkit before version 0.116. The implementation of the polkit_backend_interactive_authority_check_authorization function in polkitd allows to test for authentication and trigger authentication of unrelated processes owned by other users. This may result in a local DoS and information disclosure.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-285, CWE-862
References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1116; https://cgit.freedesktop.org/polkit/commit/?id=bc7ffad5364; https://lists.debian.org/debian-lts-announce/2018/07/msg00042.html
CVE: CVE-2018-12462
Published: 2018-07-10
Description: NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://support.microfocus.com/kb/doc.php?id=7016795; https://support.microfocus.com/kb/doc.php?id=7016795
CVE: CVE-2018-13863
Published: 2018-07-10
Description: The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
CVSS Score: 7.5 (HIGH)
References: https://github.com/mongodb/js-bson/commit/bd61c45157c53a1698ff23770160cf4783e9ea4a; https://snyk.io/vuln/npm:bson:20180225; https://github.com/mongodb/js-bson/commit/bd61c45157c53a1698ff23770160cf4783e9ea4a
CVE: CVE-2018-13865
Published: 2018-07-10
Description: An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/idreamsoft/iCMS/issues/27; https://github.com/idreamsoft/iCMS/issues/27
CVE: CVE-2017-5704
Published: 2018-07-10
Description: Platform sample code firmware included with 4th Gen Intel Core Processor, 5th Gen Intel Core Processor, 6th Gen Intel Core Processor, and 7th Gen Intel Core Processor potentially exposes password information in memory to a local attacker with administrative privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-522
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00160.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00160.html
CVE: CVE-2018-13866
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer over-read in the function H5F_addr_decode_len in H5Fint.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13867
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is an out of bounds read in the function H5F__accum_read in H5Faccum.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13868
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_fill_old_decode in H5Ofill.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13869
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a memcpy parameter overlap in the function H5O_link_decode in H5Olink.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13870
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer over-read in the function H5O_link_decode in H5Olink.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13871
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer overflow in the function H5FL_blk_malloc in H5FL.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13872
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a heap-based buffer overflow in the function H5G_ent_decode in H5Gent.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13873
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a buffer over-read in H5O_chunk_deserialize in H5Ocache.c.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13874
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer overflow in the function H5FD_sec2_read in H5FDsec2.c, related to HDmemset.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13875
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is an out-of-bounds read in the function H5VM_memcpyvv in H5VM.c.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-13876
Published: 2018-07-10
Description: An issue was discovered in the HDF HDF5 1.8.20 library. There is a stack-based buffer overflow in the function H5FD_sec2_read in H5FDsec2.c, related to HDread.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/TeamSeri0us/pocs/tree/master/hdf5; https://github.com/TeamSeri0us/pocs/tree/master/hdf5
CVE: CVE-2018-3619
Published: 2018-07-10
Description: Information disclosure vulnerability in storage media in systems with Intel Optane memory module with Whole Disk Encryption may allow an attacker to recover data via physical access.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-200
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00114.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00114.html
CVE: CVE-2018-3627
Published: 2018-07-10
Description: Logic bug in Intel Converged Security Management Engine 11.x may allow an attacker to execute arbitrary code via local privileged access.
CVSS Score: 8.2 (HIGH)
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00118.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-3628
Published: 2018-07-10
Description: Buffer overflow in HTTP handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x, 9.x, 10.x, and 11.x may allow an attacker to execute arbitrary code via the same subnet.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1041362; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_us
CVE: CVE-2018-3629
Published: 2018-07-10
Description: Buffer overflow in event handler in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 3.x, 4.x, 5.x, 6.x, 7.x, 8.x, 9.x, 10.x, and 11.x may allow an attacker to cause a denial of service via the same subnet.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.securitytracker.com/id/1041362; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_us
CVE: CVE-2018-3632
Published: 2018-07-10
Description: Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10.x / 11.0 / 11.5 / 11.6 / 11.7 / 11.10 / 11.20 could be triggered by an attacker with local administrator permission on the system.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: http://www.securitytracker.com/id/1041362; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_us
CVE: CVE-2018-3652
Published: 2018-07-10
Description: Existing UEFI setting restrictions for DCI (Direct Connect Interface) in 5th and 6th generation Intel Xeon Processor E3 Family, Intel Xeon Scalable processors, and Intel Xeon Processor D Family allows a limited physical presence attacker to potentially access platform secrets via debug interfaces.
CVSS Score: 7.6 (HIGH)
CWE: CWE-200
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00127.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-3667
Published: 2018-07-10
Description: Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution of arbitrary code and potential privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1188
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00140.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00140.html
CVE: CVE-2018-3668
Published: 2018-07-10
Description: Unquoted service paths in Intel Processor Diagnostic Tool (IPDT) before version 4.1.0.27 allows a local attacker to potentially execute arbitrary code.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00140.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00140.html
CVE: CVE-2018-3682
Published: 2018-07-10
Description: BMC Firmware in Intel server boards, compute modules, and systems potentially allow an attacker with administrative privileges to make unauthorized read\writes to the SMBUS.
CVSS Score: 8.2 (HIGH)
CWE: CWE-269
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00130.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00130.html