deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-19887
Published: 2019-12-18
Description: bitstr_tell at bitstr.c in ffjpeg through 2019-08-21 has a NULL pointer dereference related to jfif_encode.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/rockcarry/ffjpeg/issues/14; https://github.com/rockcarry/ffjpeg/issues/14
CVE: CVE-2019-19888
Published: 2019-12-18
Description: jfif_decode in jfif.c in ffjpeg through 2019-08-21 has a divide-by-zero error.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/rockcarry/ffjpeg/issues/13; https://github.com/rockcarry/ffjpeg/issues/13
CVE: CVE-2019-19889
Published: 2019-12-18
Description: An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. The attacker can discover admin credentials in the backup file, aka backupsettings.conf.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319
References: https://github.com/V1n1v131r4/HGB10R-2; https://github.com/V1n1v131r4/HGB10R-2
CVE: CVE-2019-19890
Published: 2019-12-18
Description: An issue was discovered on Humax Wireless Voice Gateway HGB10R-2 20160817_1855 devices. Admin credentials are sent over cleartext HTTP.
CVSS Score: 7.5 (HIGH)
CWE: CWE-319, CWE-522
References: https://github.com/V1n1v131r4/HGB10R-2; https://github.com/V1n1v131r4/HGB10R-2
CVE: CVE-2018-1311
Published: 2019-12-18
Description: The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed in the maintained version of the library and has no current mitigation other than to disable DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416
References: http://www.openwall.com/lists/oss-security/2024/02/16/1; https://access.redhat.com/errata/RHSA-2020:0702; https://access.redhat.com/errata/RHSA-2020:0704
CVE: CVE-2019-11995
Published: 2019-12-18
Description: Security vulnerabilities in HPE UIoT version 1.2.4.2 could allow unauthorized remote access and access to sensitive data. HPE has addressed this issue in HPE UIoT: For customers with release UIoT 1.2.4.2 fixes are made available with 1.2.4.2 RP3 HF1. For customers with release older than 1.2.4.2, such as 1.2.4.1, 1.2.4.0, the resolution will be to upgrade to 1.2.4.2 RP3 HF1 Customers are requested to upgrade to the updated versions or contact HPE support for further assistance.
CVSS Score: 7.5 (HIGH)
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03954en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03954en_us
CVE: CVE-2019-16782
Published: 2019-12-18
Description: There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session. The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-208, CWE-203
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html; http://www.openwall.com/lists/oss-security/2019/12/18/2; http://www.openwall.com/lists/oss-security/2019/12/18/3
CVE: CVE-2019-18267
Published: 2019-12-18
Description: An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site scripting vulnerability that may allow session hijacking, disclosure of sensitive data, cross-site request forgery (CSRF) attacks, and remote code execution.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.us-cert.gov/ics/advisories/icsa-19-351-01; https://www.us-cert.gov/ics/advisories/icsa-19-351-01
CVE: CVE-2019-19688
Published: 2019-12-18
Description: A privilege escalation vulnerability in Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited allowing an attacker to place a malicious DLL file into the application directory and elevate privileges.
CVSS Score: 7.8 (HIGH)
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-21674; https://helpcenter.trendmicro.com/en-us/article/TMKA-21674
CVE: CVE-2019-19689
Published: 2019-12-18
Description: Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the program uses.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://helpcenter.trendmicro.com/en-us/article/TMKA-21674; https://helpcenter.trendmicro.com/en-us/article/TMKA-21674
CVE: CVE-2019-19690
Published: 2019-12-18
Description: Trend Micro Mobile Security for Android (Consumer) versions 10.3.1 and below on Android 8.0+ has an issue in which an attacker could bypass the product's App Password Protection feature.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-521
References: https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124037.aspx; https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124037.aspx
CVE: CVE-2019-5074
Published: 2019-12-18
Description: An exploitable stack buffer overflow vulnerability exists in the iocheckd service ''I/O-Check'' functionality of WAGO PFC200 Firmware version 03.01.07(13), WAGO PFC200 Firmware version 03.00.39(12) and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a stack buffer overflow, resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0863; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0863
CVE: CVE-2019-5077
Published: 2019-12-18
Description: An exploitable denial-of-service vulnerability exists in the iocheckd service ‘’I/O-Chec’’ functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC 100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a denial of service, resulting in the device entering an error state where it ceases all network communications. An attacker can send unauthenticated packets to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0869; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0869
CVE: CVE-2019-5081
Published: 2019-12-18
Description: An exploitable heap buffer overflow vulnerability exists in the iocheckd service ''I/O-Chec'' functionality of WAGO PFC 200 Firmware version 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow, potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0873; https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0874; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0873
CVE: CVE-2019-7621
Published: 2019-12-18
Description: Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting (XSS) flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboard containing the visualization it could execute JavaScript in the victimï¿½s browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.elastic.co/t/elastic-stack-6-8-6-and-7-5-1-security-update/212390; https://www.elastic.co/community/security/; https://discuss.elastic.co/t/elastic-stack-6-8-6-and-7-5-1-security-update/212390
CVE: CVE-2019-15575
Published: 2019-12-18
Description: A command injection exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77, CWE-77
References: https://hackerone.com/reports/682442; https://hackerone.com/reports/682442
CVE: CVE-2019-15576
Published: 2019-12-18
Description: An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed an attacker to view private system notes from a GraphQL endpoint.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-862
References: https://hackerone.com/reports/633001; https://hackerone.com/reports/633001
CVE: CVE-2019-15577
Published: 2019-12-18
Description: An information disclosure vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.12 that allowed project milestones to be disclosed via groups browsing.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-307
References: https://hackerone.com/reports/636560; https://hackerone.com/reports/636560
CVE: CVE-2019-15580
Published: 2019-12-18
Description: An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even though pipeline visibility was restricted.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-201, CWE-200
References: https://hackerone.com/reports/667408; https://hackerone.com/reports/667408
CVE: CVE-2019-15589
Published: 2019-12-18
Description: An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://hackerone.com/reports/497047; https://hackerone.com/reports/497047
CVE: CVE-2019-15591
Published: 2019-12-18
Description: An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: https://hackerone.com/reports/676976; https://hackerone.com/reports/676976
CVE: CVE-2019-15596
Published: 2019-12-18
Description: A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/695416; https://hackerone.com/reports/695416
CVE: CVE-2019-15597
Published: 2019-12-18
Description: A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://hackerone.com/reports/703412; https://hackerone.com/reports/703412
CVE: CVE-2019-15598
Published: 2019-12-18
Description: A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-78
References: https://hackerone.com/reports/703415; https://hackerone.com/reports/703415
CVE: CVE-2019-15599
Published: 2019-12-18
Description: A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://hackerone.com/reports/701183; https://hackerone.com/reports/701183
CVE: CVE-2019-15600
Published: 2019-12-18
Description: A Path traversal exists in http_server which allows an attacker to read arbitrary system files.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/692262; https://hackerone.com/reports/692262
CVE: CVE-2019-18571
Published: 2019-12-18
Description: The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a reflected cross-site scripting vulnerability in the My Access Live module [MAL]. An authenticated malicious local user could potentially exploit this vulnerability by sending crafted URL with scripts. When victim users access the module through their browsers, the malicious code gets injected and executed by the web browser in the context of the vulnerable web application.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://community.rsa.com/docs/DOC-109310; https://community.rsa.com/docs/DOC-109310
CVE: CVE-2019-18572
Published: 2019-12-18
Description: The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain an Improper Authentication vulnerability. A Java JMX agent running on the remote host is configured with plain text password authentication. An unauthenticated remote attacker can connect to the JMX agent and monitor and manage the Java application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-306, CWE-522
References: https://community.rsa.com/docs/DOC-109310; https://community.rsa.com/docs/DOC-109310
CVE: CVE-2019-18573
Published: 2019-12-18
Description: The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious local user could potentially exploit this vulnerability as the session token is exposed as part of the URL. A remote attacker can gain access to victim’s session and perform arbitrary actions with privileges of the user within the compromised session.
CVSS Score: 8.8 (HIGH)
CWE: CWE-598, CWE-384
References: https://community.rsa.com/docs/DOC-109310; https://community.rsa.com/docs/DOC-109310
CVE: CVE-2019-18994
Published: 2019-12-18
Description: Due to a lack of file length check, the HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier crashes when trying to load an empty *.JPR application file. An attacker with access to the file system might be able to cause application malfunction such as denial of service.
CVSS Score: 3.9 (LOW)
CWE: CWE-20, CWE-20
References: http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch; http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-18995
Published: 2019-12-18
Description: The HMISimulator component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier fails to validate the content-length field for HTTP requests, exposing HMISimulator to denial of service via crafted HTTP requests manipulating the content-length setting.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch; http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-18996
Published: 2019-12-18
Description: Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in the application’s context.
CVSS Score: 7.1 (HIGH)
CWE: CWE-424, CWE-426
References: http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch; http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-18997
Published: 2019-12-18
Description: The HMISimulator component of ABB PB610 Panel Builder 600 uses the readFile/writeFile interface to manipulate the work file. Path configuration in PB610 HMISimulator versions 2.8.0.424 and earlier potentially allows access to files outside of the working directory, thus potentially supporting unauthorized file access.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-424
References: http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch; http://search.abb.com/library/Download.aspx?DocumentID=3ADR010466&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2019-19724
Published: 2019-12-18
Description: Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
CVSS Score: 7.5 (HIGH)
CWE: CWE-276
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html; http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html; https://github.com/sylabs/singularity/releases/tag/v3.5.2
CVE: CVE-2019-1387
Published: 2019-12-18
Description: An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.
CVSS Score: 8.8 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html; http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html; https://access.redhat.com/errata/RHSA-2019:4356
CVE: CVE-2019-5073
Published: 2019-12-18
Description: An exploitable information exposure vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause an external tool to fail, resulting in uninitialized stack data to be copied to the response packet buffer. An attacker can send unauthenticated packets to trigger this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0862; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0862
CVE: CVE-2019-5075
Published: 2019-12-18
Description: An exploitable stack buffer overflow vulnerability exists in the command line utility getcouplerdetails of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets sent to the iocheckd service "I/O-Check" can cause a stack buffer overflow in the sub-process getcouplerdetails, resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0864; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0864
CVE: CVE-2019-5078
Published: 2019-12-18
Description: An exploitable denial of service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a denial of service, resulting in the device entering an error state where it ceases all network communications. An attacker can send unauthenticated packets to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0870; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0870
CVE: CVE-2019-5079
Published: 2019-12-18
Description: An exploitable heap buffer overflow vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A specially crafted set of packets can cause a heap buffer overflow, potentially resulting in code execution. An attacker can send unauthenticated packets to trigger this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0871; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0871
CVE: CVE-2019-5080
Published: 2019-12-18
Description: An exploitable denial-of-service vulnerability exists in the iocheckd service "I/O-Check" functionality of WAGO PFC 200 Firmware versions 03.01.07(13) and 03.00.39(12), and WAGO PFC100 Firmware version 03.00.39(12). A single packet can cause a denial of service and weaken credentials resulting in the default documented credentials being applied to the device. An attacker can send an unauthenticated packet to trigger this vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0872; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0872
CVE: CVE-2019-5469
Published: 2019-12-18
Description: An IDOR vulnerability exists in GitLab <v12.1.2, <v12.0.4, and <v11.11.6 that allowed uploading files from project archive to replace other users files potentially allowing an attacker to replace project binaries or other uploaded assets.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://gitlab.com/gitlab-org/gitlab-ce/issues/60551; https://hackerone.com/reports/534794; https://gitlab.com/gitlab-org/gitlab-ce/issues/60551
CVE: CVE-2019-5486
Published: 2019-12-18
Description: A authentication bypass vulnerability exists in GitLab CE/EE <v12.3.2, <v12.2.6, and <v12.1.10 in the Salesforce login integration that could be used by an attacker to create an account that bypassed domain restrictions and email verification requirements.
CVSS Score: 8.8 (HIGH)
CWE: CWE-288, CWE-287
References: https://hackerone.com/reports/617896; https://hackerone.com/reports/617896
CVE: CVE-2019-5487
Published: 2019-12-18
Description: An improper access control vulnerability exists in Gitlab EE <v12.3.3, <v12.2.7, & <v12.1.13 that allowed the group search feature with Elasticsearch to return private code, merge requests and commits.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://hackerone.com/reports/692252; https://hackerone.com/reports/692252
CVE: CVE-2019-0131
Published: 2019-12-18
Description: Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
CVE: CVE-2019-0165
Published: 2019-12-18
Description: Insufficient Input validation in the subsystem for Intel(R) CSME before versions 12.0.45,13.0.10 and 14.0.10 may allow a privileged user to potentially enable denial of service via local access.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
CVE: CVE-2019-0166
Published: 2019-12-18
Description: Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html