deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-5948
Published: 2017-05-11
Description: An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: https://alephsecurity.com/vulns/aleph-2017008; https://alephsecurity.com/vulns/aleph-2017008
CVE: CVE-2017-8850
Published: 2017-05-11
Description: An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://alephsecurity.com/vulns/aleph-2017020; https://alephsecurity.com/vulns/aleph-2017020
CVE: CVE-2017-8851
Published: 2017-05-11
Description: An issue was discovered on OnePlus One and X devices. Due to a lenient updater-script on the OnePlus One and X OTA images, the fact that both products use the same OTA verification keys, and the fact that both products share the same 'ro.build.product' system property, attackers can install OTAs of one product over the other, even on locked bootloaders. That could theoretically allow for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. Moreover, the vulnerability may result in having the device unusable until a Factory Reset is performed. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-319
References: https://alephsecurity.com/vulns/aleph-2017021; https://alephsecurity.com/vulns/aleph-2017021
CVE: CVE-2017-7472
Published: 2017-05-11
Description: The KEYS subsystem in the Linux kernel before 4.10.13 allows local users to cause a denial of service (memory consumption) via a series of KEY_REQKEY_DEFL_THREAD_KEYRING keyctl_set_reqkey_keyring calls.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c9f838d104fed6f2f61d68164712e3204bf5271b; http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html; http://openwall.com/lists/oss-security/2017/05/11/1
CVE: CVE-2017-8903
Published: 2017-05-11
Description: Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/98426; http://www.securitytracker.com/id/1038386; https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/
CVE: CVE-2017-8904
Published: 2017-05-11
Description: Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/98428; http://www.securitytracker.com/id/1038387; https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/
CVE: CVE-2017-8905
Published: 2017-05-11
Description: Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
CVSS Score: 8.8 (HIGH)
CWE: CWE-682
References: http://www.securityfocus.com/bid/98436; http://www.securitytracker.com/id/1038388; https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/
CVE: CVE-2017-8906
Published: 2017-05-11
Description: An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as used by the x265_encoder_encode dependency in libbpg and other products. A small picture can cause an integer underflow, which leads to a Denial of Service in the process of encoding.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191
References: https://bitbucket.org/multicoreware/x265/issues/345/integer-underflow-in-x265-source-common; https://bitbucket.org/multicoreware/x265/issues/345/integer-underflow-in-x265-source-common
CVE: CVE-2017-8360
Published: 2017-05-12
Description: Conexant Systems mictray64 task, as used on HP Elite, EliteBook, ProBook, and ZBook systems, leaks sensitive data (keystrokes) to any process. In mictray64.exe (mic tray icon) 1.0.0.46, a LowLevelKeyboardProc Windows hook is used to capture keystrokes. This data is leaked via unintended channels: debug messages accessible to any process that is running in the current user session, and filesystem access to C:\Users\Public\MicTray.log by any process.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securitytracker.com/id/1038527; https://www.modzero.ch/advisories/MZ-17-01-Conexant-Keylogger.txt; https://www.modzero.ch/modlog/archives/2017/05/11/en_keylogger_in_hewlett-packard_audio_driver/index.html
CVE: CVE-2017-8900
Published: 2017-05-12
Description: LightDM through 1.22.0, when systemd is used in Ubuntu 16.10 and 17.x, allows physically proximate attackers to bypass intended AppArmor restrictions and visit the home directories of arbitrary users by establishing a guest session.
CVSS Score: 4.6 (MEDIUM)
References: http://www.securityfocus.com/bid/98554; https://launchpad.net/bugs/1663157; https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8900.html
CVE: CVE-2017-8908
Published: 2017-05-12
Description: The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PostScript document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/98427; https://bugs.ghostscript.com/show_bug.cgi?id=697810; http://www.securityfocus.com/bid/98427
CVE: CVE-2017-8911
Published: 2017-05-12
Description: An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191
References: http://www.debian.org/security/2017/dsa-3869; https://github.com/verdammelt/tnef/issues/23; https://security.gentoo.org/glsa/201708-02
CVE: CVE-2017-8912
Published: 2017-05-12
Description: CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94, CWE-94
References: https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/; https://www.exploit-db.com/exploits/41997/; https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/
CVE: CVE-2015-6542
Published: 2017-05-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-3403.  Reason: This candidate is a reservation duplicate of CVE-2016-3403.  Notes: All CVE users should reference CVE-2016-3403 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-0064
Published: 2017-05-12
Description: A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka "Internet Explorer Security Feature Bypass Vulnerability."
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/98121; http://www.securitytracker.com/id/1038447; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0064
CVE: CVE-2017-0077
Published: 2017-05-12
Description: The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow a local authenticated attacker to execute a specially crafted application to obtain information, or in Windows 7 and later, cause denial of service, aka "Win32k Information Disclosure Vulnerability."
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/98114; http://www.securitytracker.com/id/1038454; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0077
CVE: CVE-2017-0171
Published: 2017-05-12
Description: Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 are configured to answer version queries, aka "Windows DNS Server Denial of Service Vulnerability".
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98097; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0171; http://www.securityfocus.com/bid/98097
CVE: CVE-2017-0175
Published: 2017-05-12
Description: The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information via a specially crafted document, aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-0220, CVE-2017-0258, and CVE-2017-0259.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98110; http://www.securitytracker.com/id/1038452; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0175
CVE: CVE-2017-0190
Published: 2017-05-12
Description: The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI Information Disclosure Vulnerability."
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98298; http://www.securitytracker.com/id/1038451; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0190
CVE: CVE-2017-0212
Published: 2017-05-12
Description: Windows Hyper-V allows an elevation of privilege vulnerability when Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 fail to properly validate vSMB packet data, aka "Windows Hyper-V vSMB Elevation of Privilege Vulnerability".
CVSS Score: 7.6 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98099; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0212; http://www.securityfocus.com/bid/98099
CVE: CVE-2017-0213
Published: 2017-05-12
Description: Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0214.
CVSS Score: 7.3 (HIGH)
References: http://www.securityfocus.com/bid/98102; http://www.securitytracker.com/id/1038457; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213
CVE: CVE-2017-0214
Published: 2017-05-12
Description: Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when Windows fails to properly validate input before loading type libraries, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0213.
CVSS Score: 7.0 (HIGH)
References: http://www.securityfocus.com/bid/98103; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0214; https://www.exploit-db.com/exploits/42021/
CVE: CVE-2017-0220
Published: 2017-05-12
Description: The Windows kernel in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 Gold allows authenticated attackers to obtain sensitive information via a specially crafted document, aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-0175, CVE-2017-0258, and CVE-2017-0259.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98111; http://www.securitytracker.com/id/1038445; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0220
CVE: CVE-2017-0221
Published: 2017-05-12
Description: A vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0227 and CVE-2017-0240.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98147; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0221; http://www.securityfocus.com/bid/98147
CVE: CVE-2017-0222
Published: 2017-05-12
Description: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0226.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://www.securityfocus.com/bid/98127; http://www.securitytracker.com/id/1038423; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0222
CVE: CVE-2017-0224
Published: 2017-05-12
Description: A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98214; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0224; http://www.securityfocus.com/bid/98214
CVE: CVE-2017-0226
Published: 2017-05-12
Description: A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0222.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98139; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0226; http://www.securityfocus.com/bid/98139
CVE: CVE-2017-0227
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0221 and CVE-2017-0240.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98281; http://www.securitytracker.com/id/1038424; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0227
CVE: CVE-2017-0228
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98164; http://www.securitytracker.com/id/1038425; http://www.securitytracker.com/id/1038426
CVE: CVE-2017-0229
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98217; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0229; http://www.securityfocus.com/bid/98217
CVE: CVE-2017-0230
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98222; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0230; http://www.securityfocus.com/bid/98222
CVE: CVE-2017-0231
Published: 2017-05-12
Description: A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98173; http://www.securitytracker.com/id/1038455; http://www.securitytracker.com/id/1038456
CVE: CVE-2017-0233
Published: 2017-05-12
Description: An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka "Microsoft Edge Elevation of Privilege Vulnerability." This CVE ID is unique from CVE-2017-0241.
CVSS Score: 8.3 (HIGH)
References: http://www.securityfocus.com/bid/98179; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0233; http://www.securityfocus.com/bid/98179
CVE: CVE-2017-0234
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98229; http://www.securitytracker.com/id/1038431; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0234
CVE: CVE-2017-0235
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0236, and CVE-2017-0238.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98230; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0235; http://www.securityfocus.com/bid/98230
CVE: CVE-2017-0236
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, and CVE-2017-0238.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98234; http://www.securitytracker.com/id/1038431; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0236
CVE: CVE-2017-0238
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript scripting engines handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, and CVE-2017-0236.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98237; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0238; http://www.securityfocus.com/bid/98237
CVE: CVE-2017-0240
Published: 2017-05-12
Description: A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0221 and CVE-2017-0227.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98203; http://www.securitytracker.com/id/1038424; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0240
CVE: CVE-2017-0241
Published: 2017-05-12
Description: An elevation of privilege vulnerability exists when Microsoft Edge renders a domain-less page in the URL, which could allow Microsoft Edge to perform actions in the context of the Intranet Zone and access functionality that is not typically available to the browser when browsing in the context of the Internet Zone, aka "Microsoft Edge Elevation of Privilege Vulnerability." This CVE ID is unique from CVE-2017-0233.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/98208; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0241; http://www.securityfocus.com/bid/98208
CVE: CVE-2017-0242
Published: 2017-05-12
Description: An information disclosure vulnerability exists in the way some ActiveX objects are instantiated, aka "Microsoft ActiveX Information Disclosure Vulnerability."
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98275; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0242; http://www.securityfocus.com/bid/98275
CVE: CVE-2017-0244
Published: 2017-05-12
Description: The kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows locally authenticated attackers to gain privileges via a crafted application, or in Windows 7 for x64-based systems, cause denial of service, aka "Windows Kernel Elevation of Privilege Vulnerability."
CVSS Score: 6.7 (MEDIUM)
References: http://www.securityfocus.com/bid/98109; http://www.securitytracker.com/id/1038453; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0244
CVE: CVE-2017-0245
Published: 2017-05-12
Description: The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attacker to execute a specially crafted application to obtain kernel information, aka "Win32k Information Disclosure Vulnerability."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98115; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0245; https://www.exploit-db.com/exploits/42008/