deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-11153
Published: 2019-11-14
Description: Memory corruption issues in Intel(R) PROSet/Wireless WiFi Software extension DLL before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, information disclosure and a denial of service via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00287.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00287.html
CVE: CVE-2019-11154
Published: 2019-11-14
Description: Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of service and information disclosure via local access.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00288.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00288.html
CVE: CVE-2019-11155
Published: 2019-11-14
Description: Improper directory permissions in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable denial of service and information disclosure via local access.
CVSS Score: 7.1 (HIGH)
CWE: CWE-732
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00288.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00288.html
CVE: CVE-2019-11156
Published: 2019-11-14
Description: Logic errors in Intel(R) PROSet/Wireless WiFi Software before version 21.40 may allow an authenticated user to potentially enable escalation of privilege, denial of service, and information disclosure via local access.
CVSS Score: 7.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00288.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00288.html
CVE: CVE-2019-11168
Published: 2019-11-14
Description: Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via network access.
CVSS Score: 9.1 (CRITICAL)
References: https://support.f5.com/csp/article/K64346530?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://support.f5.com/csp/article/K64346530?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-11170
Published: 2019-11-14
Description: Authentication bypass in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11171
Published: 2019-11-14
Description: Heap corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure, escalation of privilege and/or denial of service via network access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11172
Published: 2019-11-14
Description: Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11173
Published: 2019-11-14
Description: Insufficient session validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure and/or denial of service via local access.
CVSS Score: 7.1 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11174
Published: 2019-11-14
Description: Insufficient access control in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable information disclosure via network access.
CVSS Score: 5.3 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11175
Published: 2019-11-14
Description: Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11177
Published: 2019-11-14
Description: Unhandled exception in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11178
Published: 2019-11-14
Description: Stack overflow in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure and/or denial of service via network access.
CVSS Score: 8.1 (HIGH)
CWE: CWE-120
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11179
Published: 2019-11-14
Description: Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an authenticated user to potentially enable information disclosure via network access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11180
Published: 2019-11-14
Description: Insufficient input validation in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11181
Published: 2019-11-14
Description: Out of bound read in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-11182
Published: 2019-11-14
Description: Memory corruption in Intel(R) Baseboard Management Controller firmware may allow an unauthenticated user to potentially enable denial of service via network access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00313.html
CVE: CVE-2019-14565
Published: 2019-11-14
Description: Insufficient initialization in Intel(R) SGX SDK Windows versions 2.4.100.51291 and earlier, and Linux versions 2.6.100.51363 and earlier, may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://support.f5.com/csp/article/K57201259?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html; https://support.f5.com/csp/article/K57201259?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-14566
Published: 2019-11-14
Description: Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://support.f5.com/csp/article/K57201259?utm_source=f5support&amp%3Butm_medium=RSS; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00293.html; https://support.f5.com/csp/article/K57201259?utm_source=f5support&amp%3Butm_medium=RSS
CVE: CVE-2019-14602
Published: 2019-11-14
Description: Improper permissions in the installer for the Nuvoton* CIR Driver versions 1.02.1002 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00309.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00309.html
CVE: CVE-2019-14818
Published: 2019-11-14
Description: A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401, CWE-401
References: https://access.redhat.com/errata/RHSA-2020:0165; https://access.redhat.com/errata/RHSA-2020:0166; https://access.redhat.com/errata/RHSA-2020:0168
CVE: CVE-2019-15332
Published: 2019-11-14
Description: The Lava Z61 Android device with a build fingerprint of LAVA/Z61_2GB/Z61_2GB:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-269
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15333
Published: 2019-11-14
Description: The Lava Flair Z1 Android device with a build fingerprint of LAVA/Z1/Z1:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15334
Published: 2019-11-14
Description: The Lava Iris 88 Go Android device with a build fingerprint of LAVA/iris88_go/iris88_go:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15335
Published: 2019-11-14
Description: The Lava Z92 Android device with a build fingerprint of LAVA/Z92/Z92:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15336
Published: 2019-11-14
Description: The Lava Z61 Turbo Android device with a build fingerprint of LAVA/Z61_Turbo/Z61_Turbo:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.31) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15337
Published: 2019-11-14
Description: The Lava Z81 Android device with a build fingerprint of LAVA/Z81/Z81:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.31) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15338
Published: 2019-11-14
Description: The Lava Iris 88 Lite Android device with a build fingerprint of LAVA/iris88_lite/iris88_lite:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15339
Published: 2019-11-14
Description: The Lava Z60s Android device with a build fingerprint of LAVA/Z60s/Z60s:8.1.0/O11019/[PII_REDACTED]:user/release-keys contains a pre-installed app with a package name of com.android.lava.powersave app (versionCode=400, versionName=v4.0.27) that allows any app co-located on the device to programmatically disable and enable Wi-Fi without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15340
Published: 2019-11-14
Description: The Xiaomi Redmi 6 Pro Android device with a build fingerprint of xiaomi/sakura_india/sakura_india:8.1.0/OPM1.171019.019/V9.6.4.0.ODMMIFD:user/release-keys contains a pre-installed app with a package name of com.huaqin.factory app (versionCode=1, versionName=QL1715_[PII_REDACTED]06) that allows any app co-located on the device to programmatically disable and enable Wi-Fi, Bluetooth, and GPS without the corresponding access permission through an exported interface.
CVSS Score: 3.3 (LOW)
CWE: CWE-732
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15341
Published: 2019-11-14
Description: The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15342
Published: 2019-11-14
Description: The Tecno Camon iAir 2 Plus Android device with a build fingerprint of TECNO/H622/TECNO-ID3k:8.1.0/O11019/E-180914V83:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands via shell script to be executed as the system user that are triggered by writing an attacker-selected message to the logcat log. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing commands as the system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15343
Published: 2019-11-14
Description: The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.8). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands via shell script to be executed as the system user that are triggered by writing an attacker-selected message to the logcat log. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing commands as the system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15344
Published: 2019-11-14
Description: The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.8). This app contains an exported service named com.lovelyfont.manager.FontCoverService that allows any app co-located on the device to supply arbitrary commands to be executed as the system user. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. In addition to the local attack surface, its accompanying app with a package name of com.ekesoo.lovelyhifonts makes network requests using HTTP and an attacker can perform a Man-in-the-Middle (MITM) attack on the connection to inject a command in a network response that will be executed as the system user by the com.lovelyfont.defcontainer app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing commands as the system user can allow a third-party app to factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS Score: 8.1 (HIGH)
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/
CVE: CVE-2019-15345
Published: 2019-11-14
Description: The Tecno Camon iClick Android device with a build fingerprint of TECNO/H633/TECNO-IN6:8.1.0/O11019/A-180409V96:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.8). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
CVSS Score: 7.8 (HIGH)
CWE: CWE-668
References: https://www.kryptowire.com/android-firmware-2019/; https://www.kryptowire.com/android-firmware-2019/