deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19631
Published: 2020-01-24
Description: An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4, 6.3 through 6.3.9, 7.0 through 7.0.3, and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5, 4.7 through 4.7.7, 5.0 through 5.0.1, and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. A read-only user can access sensitive information via an API endpoint that reveals session cookies of authenticated administrators, leading to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://know.bishopfox.com/advisories; https://know.bishopfox.com/advisories/big-monitoring-fabric; https://know.bishopfox.com/advisories
CVE: CVE-2020-5219
Published: 2020-01-24
Description: Angular Expressions before version 1.0.1 has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.
CVSS Score: 8.7 (HIGH)
CWE: CWE-74, CWE-74
References: http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html; https://github.com/peerigon/angular-expressions/commit/061addfb9a9e932a970e5fcb913d020038e65667; https://github.com/peerigon/angular-expressions/security/advisories/GHSA-hxhm-96pp-2m43
CVE: CVE-2013-1594
Published: 2020-01-24
Description: An Information Disclosure vulnerability exists via a GET request in Vivotek PT7135 IP Camera 0300a and 0400a due to wireless keys and 3rd party credentials stored in clear text.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.exploit-db.com/exploits/25139; http://www.securityfocus.com/bid/59572; https://exchange.xforce.ibmcloud.com/vulnerabilities/83943
CVE: CVE-2014-1922
Published: 2020-01-24
Description: Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660; http://koha-community.org/security-release-february-2014/; http://www.openwall.com/lists/oss-security/2014/02/07/10
CVE: CVE-2014-1923
Published: 2020-01-24
Description: Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661; http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662; http://koha-community.org/security-release-february-2014/
CVE: CVE-2014-1924
Published: 2020-01-24
Description: The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666; http://koha-community.org/security-release-february-2014/; http://www.openwall.com/lists/oss-security/2014/02/07/10
CVE: CVE-2014-1925
Published: 2020-01-24
Description: SQL injection vulnerability in the MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged by remote attackers using CVE-2014-1924.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666; http://koha-community.org/security-release-february-2014/; http://www.openwall.com/lists/oss-security/2014/02/07/10
CVE: CVE-2015-4041
Published: 2020-01-24
Description: The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://openwall.com/lists/oss-security/2015/05/15/1; https://bugzilla.suse.com/show_bug.cgi?id=928749; https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940
CVE: CVE-2015-4042
Published: 2020-01-24
Description: Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://openwall.com/lists/oss-security/2015/05/15/1; https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940; http://openwall.com/lists/oss-security/2015/05/15/1
CVE: CVE-2020-6961
Published: 2020-01-24
Description: In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-256, CWE-522
References: https://www.us-cert.gov/ics/advisories/icsma-20-023-01; https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf; https://www.us-cert.gov/ics/advisories/icsma-20-023-01
CVE: CVE-2020-6962
Published: 2020-01-24
Description: In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X CARESCAPE Central Station (CSCS) Versions 2.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, an input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-20, CWE-20
References: https://www.us-cert.gov/ics/advisories/icsma-20-023-01; https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf; https://www.us-cert.gov/ics/advisories/icsma-20-023-01
CVE: CVE-2020-6963
Published: 2020-01-24
Description: In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-798, CWE-20, CWE-798
References: https://www.us-cert.gov/ics/advisories/icsma-20-023-01; https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf; https://www.us-cert.gov/ics/advisories/icsma-20-023-01
CVE: CVE-2020-6964
Published: 2020-01-24
Description: In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X and CARESCAPE Central Station (CSCS) Versions 2.X, the integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.
CVSS Score: 8.6 (HIGH)
CWE: CWE-306, CWE-306
References: https://www.us-cert.gov/ics/advisories/icsma-20-023-01; https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf; https://www.us-cert.gov/ics/advisories/icsma-20-023-01
CVE: CVE-2013-1595
Published: 2020-01-24
Description: A Buffer Overflow vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via a specially crafted packet in the Authorization header field sent to the RTSP service, which could let a remote malicious user execute arbitrary code or cause a Denial of Service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://www.securityfocus.com/bid/59573; https://exchange.xforce.ibmcloud.com/vulnerabilities/83944; https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt
CVE: CVE-2013-1596
Published: 2020-01-24
Description: An Authentication Bypass Vulnerability exists in Vivotek PT7135 IP Camera 0300a and 0400a via specially crafted RTSP packets to TCP port 554.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: http://www.securityfocus.com/bid/59574; https://exchange.xforce.ibmcloud.com/vulnerabilities/83945; https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt
CVE: CVE-2014-9720
Published: 2020-01-24
Description: Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-203
References: http://openwall.com/lists/oss-security/2015/05/19/4; http://www.tornadoweb.org/en/stable/releases/v3.2.2.html; https://bugzilla.novell.com/show_bug.cgi?id=930362
CVE: CVE-2015-1525
Published: 2020-01-24
Description: audio/AudioPolicyManagerBase.cpp in Android before 5.1 allows attackers to cause a denial of service (audio_policy application outage) via a crafted application that provides a NULL device address.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://android.googlesource.com/platform/hardware/libhardware_legacy/+/2d2ea50%5E%21/; https://android.googlesource.com/platform/hardware/libhardware_legacy/+/2d2ea50%5E%21/
CVE: CVE-2015-1530
Published: 2020-01-24
Description: media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of service (integer overflow) via a crafted application that provides an invalid array size.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://android.googlesource.com/platform/frameworks/av/+/74adca9%5E%21/; https://android.googlesource.com/platform/frameworks/av/+/74adca9%5E%21/
CVE: CVE-2015-2688
Published: 2020-01-24
Description: buf_pullup in Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle unexpected arrival times of buffers with invalid layouts, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html; https://trac.torproject.org/projects/tor/ticket/15083; https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html
CVE: CVE-2015-2689
Published: 2020-01-24
Description: Tor before 0.2.4.26 and 0.2.5.x before 0.2.5.11 does not properly handle pending-connection resolve states during periods of high DNS load, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via crafted packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html; https://trac.torproject.org/projects/tor/ticket/14129; https://lists.torproject.org/pipermail/tor-talk/2015-March/037281.html
CVE: CVE-2015-2928
Published: 2020-01-24
Description: The Hidden Service (HS) server implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
References: http://openwall.com/lists/oss-security/2015/04/06/5; https://trac.torproject.org/projects/tor/ticket/15600; http://openwall.com/lists/oss-security/2015/04/06/5
CVE: CVE-2015-2929
Published: 2020-01-24
Description: The Hidden Service (HS) client implementation in Tor before 0.2.4.27, 0.2.5.x before 0.2.5.12, and 0.2.6.x before 0.2.6.7 allows remote servers to cause a denial of service (assertion failure and application exit) via a malformed HS descriptor.
CVSS Score: 7.5 (HIGH)
References: http://openwall.com/lists/oss-security/2015/04/06/5; https://trac.torproject.org/projects/tor/ticket/15601; http://openwall.com/lists/oss-security/2015/04/06/5
CVE: CVE-2019-19363
Published: 2020-01-24
Description: An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege escalation. Affected drivers and versions are: PCL6 Driver for Universal Print - Version 4.0 or later PS Driver for Universal Print - Version 4.0 or later PC FAX Generic Driver - All versions Generic PCL5 Driver - All versions RPCS Driver - All versions PostScript3 Driver - All versions PCL6 (PCL XL) Driver - All versions RPCS Raster Driver - All version
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://jvn.jp/en/jp/JVN15697526/index.html; http://packetstormsecurity.com/files/156082/Ricoh-Printer-Driver-Local-Privilege-Escalation.html; http://packetstormsecurity.com/files/156251/Ricoh-Driver-Privilege-Escalation.html
CVE: CVE-2020-6965
Published: 2020-01-24
Description: In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434, CWE-20, CWE-434
References: https://www.us-cert.gov/ics/advisories/icsma-20-023-01; https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf; https://www.us-cert.gov/ics/advisories/icsma-20-023-01
CVE: CVE-2020-6966
Published: 2020-01-24
Description: In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-326, CWE-326
References: https://www.us-cert.gov/ics/advisories/icsma-20-023-01; https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf; https://www.us-cert.gov/ics/advisories/icsma-20-023-01
CVE: CVE-2013-1597
Published: 2020-01-24
Description: A Directory Traversal vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via a specially crafted GET request, which could let a malicious user obtain user credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/59576; https://exchange.xforce.ibmcloud.com/vulnerabilities/83947; https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt
CVE: CVE-2013-1598
Published: 2020-01-24
Description: A Command Injection vulnerability exists in Vivotek PT7135 IP Cameras 0300a and 0400a via the system.ntp parameter to the farseer.out binary file, which cold let a malicious user execute arbitrary code.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: http://www.securityfocus.com/bid/59575; https://exchange.xforce.ibmcloud.com/vulnerabilities/83946; https://github.com/offensive-security/exploitdb/blob/master/exploits/hardware/webapps/25139.txt
CVE: CVE-2014-4172
Published: 2020-01-24
Description: A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html; https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718; https://bugzilla.redhat.com/show_bug.cgi?id=1131350
CVE: CVE-2020-5224
Published: 2020-01-24
Description: In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-287, CWE-326
References: https://github.com/Bouke/django-user-sessions/security/advisories/GHSA-5fq8-3q2f-4m5g; https://github.com/jazzband/django-user-sessions/commit/f0c4077e7d1436ba6d721af85cee89222ca5d2d9; https://github.com/Bouke/django-user-sessions/security/advisories/GHSA-5fq8-3q2f-4m5g
CVE: CVE-2020-7052
Published: 2020-01-24
Description: CODESYS Control V3, Gateway V3, and HMI V3 before 3.5.15.30 allow uncontrolled memory allocation which can result in a remote denial of service condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-770
References: https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12977&token=33f948eed0c2fd69d238d9515779be337ef7592d&download=; https://www.tenable.com/security/research/tra-2020-04; https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=12977&token=33f948eed0c2fd69d238d9515779be337ef7592d&download=
CVE: CVE-2020-7964
Published: 2020-01-24
Description: An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306
References: https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3; https://github.com/mirumee/saleor/releases/tag/2.9.1; https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3
CVE: CVE-2018-8654
Published: 2020-01-24
Description: An elevation of privilege vulnerability exists in Microsoft Dynamics 365 Server, aka 'Microsoft Dynamics 365 Elevation of Privilege Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8654; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8654
CVE: CVE-2019-1349
Published: 2020-01-24
Description: A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; https://access.redhat.com/errata/RHSA-2020:0228
CVE: CVE-2019-1350
Published: 2020-01-24
Description: A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350
CVE: CVE-2019-1351
Published: 2020-01-24
Description: A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-706
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351
CVE: CVE-2019-1352
Published: 2020-01-24
Description: A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; https://access.redhat.com/errata/RHSA-2020:0228
CVE: CVE-2019-1354
Published: 2020-01-24
Description: A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354
CVE: CVE-2019-1414
Published: 2020-01-24
Description: An elevation of privilege vulnerability exists in Visual Studio Code when it exposes a debug listener to users of a local computer, aka 'Visual Studio Code Elevation of Privilege Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1414; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1414
CVE: CVE-2019-1454
Published: 2020-01-24
Description: An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1454; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1454
CVE: CVE-2019-1460
Published: 2020-01-24
Description: A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
CVSS Score: 4.6 (MEDIUM)
References: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1460