deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-5045
Published: 2019-10-09
Description: A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0814; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0814
CVE: CVE-2019-5046
Published: 2019-10-09
Description: A specifically crafted jpeg2000 file embedded in a PDF file can lead to a heap corruption when opening a PDF document in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0815; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0815
CVE: CVE-2019-5047
Published: 2019-10-09
Description: An exploitable Use After Free vulnerability exists in the CharProcs parsing functionality of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a Use After Free. An attacker can craft a malicious PDF to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416, CWE-843
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0816; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0816
CVE: CVE-2019-5048
Published: 2019-10-09
Description: A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0817; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0817
CVE: CVE-2019-5050
Published: 2019-10-09
Description: A specifically crafted PDF file can lead to a heap corruption when opened in NitroPDF 12.12.1.522. With careful memory manipulation, this can lead to arbitrary code execution. In order to trigger this vulnerability, the victim would need to open the malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0819; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0819
CVE: CVE-2019-5053
Published: 2019-10-09
Description: An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. A specially crafted PDF can cause a type confusion, resulting in a use-after-free condition. An attacker can craft a malicious PDF to trigger this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0830; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0830
CVE: CVE-2019-17109
Published: 2019-10-09
Description: Koji through 1.18.0 allows remote Directory Traversal, with resultant Privilege Escalation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2019/10/09/5; https://docs.pagure.org/koji/CVE-2019-17109/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BGUXMZIAQFFNNQ7PEFDAYQCXXKJR76U/
CVE: CVE-2019-17365
Published: 2019-10-09
Description: Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2019/10/09/4; http://www.openwall.com/lists/oss-security/2019/10/10/1; http://www.openwall.com/lists/oss-security/2019/10/17/3
CVE: CVE-2019-17366
Published: 2019-10-09
Description: Citrix Application Delivery Management (ADM) 12.1 before build 54.13 has Incorrect Access Control.
CVSS Score: 8.8 (HIGH)
References: https://support.citrix.com/article/CTX261735; https://support.citrix.com/article/CTX261735
CVE: CVE-2019-17414
Published: 2019-10-09
Description: tinylcy Vino through 2017-12-15 allows remote attackers to cause a denial of service ("vn_get_string error: Resource temporarily unavailable" error and daemon crash) via a long URL.
CVSS Score: 7.5 (HIGH)
References: https://github.com/tinylcy/vino/issues/9; https://github.com/tinylcy/vino/issues/9
CVE: CVE-2019-17415
Published: 2019-10-09
Description: A Structured Exception Handler (SEH) based buffer overflow in File Sharing Wizard 1.5.0 26-8-2008 allows remote unauthenticated attackers to execute arbitrary code via the HTTP DELETE method, a similar issue to CVE-2019-16724 and CVE-2010-2331.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://packetstormsecurity.com/files/154738/File-Sharing-Wizard-1.5.0-DELETE-SEH-Buffer-Overflow.html; https://packetstormsecurity.com/files/154738/File-Sharing-Wizard-1.5.0-DELETE-SEH-Buffer-Overflow.html
CVE: CVE-2019-5699
Published: 2019-10-09
Description: NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra bootloader contains a vulnerability where the software performs an incorrect bounds check, which may lead to buffer overflow resulting in escalation of privileges and code execution. escalation of privileges, and information disclosure, code execution, denial of service, or escalation of privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4875; https://nvidia.custhelp.com/app/answers/detail/a_id/4910; https://nvidia.custhelp.com/app/answers/detail/a_id/4875
CVE: CVE-2019-5700
Published: 2019-10-09
Description: NVIDIA Shield TV Experience prior to v8.0.1, NVIDIA Tegra software contains a vulnerability in the bootloader, where it does not validate the fields of the boot image, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://nvidia.custhelp.com/app/answers/detail/a_id/4875; https://nvidia.custhelp.com/app/answers/detail/a_id/4910; https://nvidia.custhelp.com/app/answers/detail/a_id/4875
CVE: CVE-2017-2676
Published: 2019-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-2677
Published: 2019-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-2678
Published: 2019-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-2679
Published: 2019-10-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2019-17417
Published: 2019-10-10
Description: PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/lolipop1234/XXD/issues/2; https://github.com/lolipop1234/XXD/issues/2
CVE: CVE-2019-17418
Published: 2019-10-10
Description: An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=language_general&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/evi1code/Just-for-fun/issues/2; https://github.com/evi1code/Just-for-fun/issues/2
CVE: CVE-2019-17419
Published: 2019-10-10
Description: An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=user&c=admin_user&a=doGetUserInfo id parameter.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://github.com/evi1code/Just-for-fun/issues/1; https://github.com/evi1code/Just-for-fun/issues/1
CVE: CVE-2019-17420
Published: 2019-10-10
Description: In OISF LibHTP before 0.5.31, as used in Suricata 4.1.4 and other products, an HTTP protocol parsing error causes the http_header signature to not alert on a response with a single \r\n ending.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-459
References: https://github.com/OISF/libhtp/compare/0.5.30...0.5.31; https://github.com/OISF/libhtp/pull/213; https://redmine.openinfosecfoundation.org/issues/2969
CVE: CVE-2019-17426
Published: 2019-10-10
Description: Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
CVSS Score: 9.1 (CRITICAL)
References: https://github.com/Automattic/mongoose/commit/f3eca5b94d822225c04e96cbeed9f095afb3c31c; https://github.com/Automattic/mongoose/issues/8222; https://github.com/Automattic/mongoose/commit/f3eca5b94d822225c04e96cbeed9f095afb3c31c
CVE: CVE-2019-17427
Published: 2019-10-10
Description: In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/RealLinkers/CVE-2019-17427; https://seclists.org/bugtraq/2019/Nov/31; https://usn.ubuntu.com/4200-1/
CVE: CVE-2019-17070
Published: 2019-10-10
Description: The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece; https://wordpress.org/plugins/liquid-speech-balloon/#developers; https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece
CVE: CVE-2019-17071
Published: 2019-10-10
Description: The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece; https://wordpress.org/plugins/client-dash/#developers; https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece
CVE: CVE-2019-17072
Published: 2019-10-10
Description: The new-contact-form-widget (aka Contact Form Widget - Contact Query, Form Maker) plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece; https://wordpress.org/plugins/new-contact-form-widget/#description; https://gist.github.com/rezaduty/18afedba24bb1e5835010bd2de67cece
CVE: CVE-2019-17429
Published: 2019-10-10
Description: Adhouma CMS through 2019-10-09 has SQL Injection via the post.php p_id parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Adhouma/cms/issues/1; https://github.com/Adhouma/cms/issues/1
CVE: CVE-2019-17430
Published: 2019-10-10
Description: EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/eyoucms/eyoucms/blob/a809931d8ae0a94584f472cdedabf6f3cf42bd57/core/library/think/template/taglib/eyou/TagGlobal.php#L116-L119; https://github.com/eyoucms/eyoucms/issues/1; https://github.com/eyoucms/eyoucms/blob/a809931d8ae0a94584f472cdedabf6f3cf42bd57/core/library/think/template/taglib/eyou/TagGlobal.php#L116-L119
CVE: CVE-2019-17431
Published: 2019-10-10
Description: An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/Imanfeng/fastadmin/blob/master/README.md; https://github.com/Imanfeng/fastadmin/blob/master/README.md
CVE: CVE-2019-17432
Published: 2019-10-10
Description: An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability, as demonstrated by resultant XSS via the row&#91;name&#93; parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79, CWE-352
References: https://github.com/Imanfeng/fastadmin/blob/master/README.md; https://github.com/Imanfeng/fastadmin/blob/master/README.md
CVE: CVE-2019-17433
Published: 2019-10-10
Description: z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/z-song/laravel-admin/issues/3847; https://github.com/z-song/laravel-admin/issues/3847
CVE: CVE-2019-17434
Published: 2019-10-10
Description: LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/LavaLite/cms/issues/304; https://github.com/LavaLite/cms/issues/304
CVE: CVE-2019-0608
Published: 2019-10-10
Description: A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content, aka 'Microsoft Browser Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1357.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-290
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0608; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0608
CVE: CVE-2019-10923
Published: 2019-10-10
Description: An attacker with network access to an affected product may cause a denial of service condition by breaking the real-time synchronization (IRT) of the affected installation.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://cert-portal.siemens.com/productcert/html/ssa-349422.html; https://cert-portal.siemens.com/productcert/pdf/ssa-349422.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-349422.pdf
CVE: CVE-2019-10936
Published: 2019-10-10
Description: Affected devices improperly handle large amounts of specially crafted UDP packets.

This could allow an unauthenticated remote attacker to trigger a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: https://cert-portal.siemens.com/productcert/html/ssa-473245.html; https://cert-portal.siemens.com/productcert/pdf/ssa-473245.pdf; https://cert-portal.siemens.com/productcert/html/ssa-473245.html
CVE: CVE-2019-13921
Published: 2019-10-10
Description: A vulnerability has been identified in SIMATIC WinAC RTX (F) 2010 (All versions < SP3 Update 1). Affected versions of the software contain a vulnerability that could allow an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large HTTP request is sent to the executing service. The security vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the service provided by the software.
CVSS Score: 7.5 (HIGH)
CWE: CWE-410, CWE-400
References: https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-878278.pdf
CVE: CVE-2019-13929
Published: 2019-10-10
Description: A vulnerability has been identified in SIMATIC IT UADM (All versions < V1.3). An authenticated remote attacker with network access to port 1434/tcp of SIMATIC IT UADM could potentially recover a password that can be used to gain read and write access to the related TeamCenter station. The security vulnerability could be exploited only if the attacker is authenticated. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system. At the time of advisory publication no public exploitation of this security vulnerability was known.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-321, CWE-330
References: https://cert-portal.siemens.com/productcert/pdf/ssa-984700.pdf; https://cert-portal.siemens.com/productcert/pdf/ssa-984700.pdf
CVE: CVE-2019-1060
Published: 2019-10-10
Description: A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka 'MS XML Remote Code Execution Vulnerability'.
CVSS Score: 8.8 (HIGH)
CWE: CWE-611
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1060; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1060
CVE: CVE-2019-1070
Published: 2019-10-10
Description: A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1070; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1070
CVE: CVE-2019-1166
Published: 2019-10-10
Description: A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-354
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1166; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1166
CVE: CVE-2019-1230
Published: 2019-10-10
Description: An information disclosure vulnerability exists when the Windows Hyper-V Network Switch on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka 'Hyper-V Information Disclosure Vulnerability'.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1230; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1230
CVE: CVE-2019-1238
Published: 2019-10-10
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1239.
CVSS Score: 6.4 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1238; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1238
CVE: CVE-2019-1239
Published: 2019-10-10
Description: A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1238.
CVSS Score: 7.5 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1239; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1239
CVE: CVE-2019-1307
Published: 2019-10-10
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1308, CVE-2019-1335, CVE-2019-1366.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1307; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1307
CVE: CVE-2019-1308
Published: 2019-10-10
Description: A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1307, CVE-2019-1335, CVE-2019-1366.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1308; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1308
CVE: CVE-2019-1311
Published: 2019-10-10
Description: A remote code execution vulnerability exists when the Windows Imaging API improperly handles objects in memory, aka 'Windows Imaging API Remote Code Execution Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1311; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1311
CVE: CVE-2019-1313
Published: 2019-10-10
Description: An information disclosure vulnerability exists in Microsoft SQL Server Management Studio (SSMS) when it improperly enforces permissions, aka 'SQL Server Management Studio Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1376.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-755
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1313; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1313
CVE: CVE-2019-1314
Published: 2019-10-10
Description: A security feature bypass vulnerability exists in Windows 10 Mobile when Cortana allows a user to access files and folders through the locked screen, aka 'Windows 10 Mobile Security Feature Bypass Vulnerability'.
CVSS Score: 6.8 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1314; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1314
CVE: CVE-2019-1315
Published: 2019-10-10
Description: An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error Reporting Manager Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1339, CVE-2019-1342.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59, CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1315; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1315; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1315
CVE: CVE-2019-1316
Published: 2019-10-10
Description: An elevation of privilege vulnerability exists in Microsoft Windows Setup when it does not properly handle privileges, aka 'Microsoft Windows Setup Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1316; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1316
CVE: CVE-2019-1317
Published: 2019-10-10
Description: A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'.
CVSS Score: 7.3 (HIGH)
CWE: CWE-59
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1317; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1317
CVE: CVE-2019-1318
Published: 2019-10-10
Description: A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-290
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1318; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1318
CVE: CVE-2019-1319
Published: 2019-10-10
Description: An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka 'Windows Error Reporting Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1319; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1319