rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-0984 Windows Common Log File System Driver Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 1703
vendor: Microsoft
product: Windows 10 Version 1803
vendor: Microsoft
product: Windows Server, version 1803  (Server Core Installation)
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows 10 Version 1709 for 32-bit Systems
vendor: Microsoft
product: Windows 10 Version 1709
vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows 7
vendor: Microsoft
product: Windows 7 Service Pack 1
vendor: Microsoft
product: Windows 8.1
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008  Service Pack 2
vendor: Microsoft
product: Windows Server 2008 R2 Systems Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
vendor: Microsoft
product: Windows 10 Version 1903 for 32-bit Systems
vendor: Microsoft
product: Windows 10 Version 1903 for x64-based Systems
vendor: Microsoft
product: Windows 10 Version 1903 for ARM64-based Systems
vendor: Microsoft
product: Windows Server, version 1903 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:38.000Z
CVE-2019-0985 Microsoft Speech API Remote Code Execution Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Windows 7
vendor: Microsoft
product: Windows 7 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Systems Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:38.000Z
CVE-2019-0986 Windows User Profile Service Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 1703
vendor: Microsoft
product: Windows 10 Version 1803
vendor: Microsoft
product: Windows Server, version 1803  (Server Core Installation)
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows 10 Version 1709 for 32-bit Systems
vendor: Microsoft
product: Windows 10 Version 1709
vendor: Microsoft
product: Windows 10 Version 1903 for 32-bit Systems
vendor: Microsoft
product: Windows 10 Version 1903 for x64-based Systems
vendor: Microsoft
product: Windows 10 Version 1903 for ARM64-based Systems
vendor: Microsoft
product: Windows Server, version 1903 (Server Core installation)
vendor: Microsoft
product: Windows 10 Version 1507
vendor: Microsoft
product: Windows 10 Version 1607
vendor: Microsoft
product: Windows Server 2016
vendor: Microsoft
product: Windows Server 2016 (Server Core installation)
vendor: Microsoft
product: Windows 7
vendor: Microsoft
product: Windows 7 Service Pack 1
vendor: Microsoft
product: Windows 8.1
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008 Service Pack 2 (Server Core installation)
vendor: Microsoft
product: Windows Server 2008 Service Pack 2
vendor: Microsoft
product: Windows Server 2008  Service Pack 2
vendor: Microsoft
product: Windows Server 2008 R2 Systems Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1
vendor: Microsoft
product: Windows Server 2008 R2 Service Pack 1 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012
vendor: Microsoft
product: Windows Server 2012 (Server Core installation)
vendor: Microsoft
product: Windows Server 2012 R2
vendor: Microsoft
product: Windows Server 2012 R2 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.3
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0988 Scripting Engine Memory Corruption Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Internet Explorer 10
vendor: Microsoft
product: Internet Explorer 11
vendor: Microsoft
product: Microsoft Edge (EdgeHTML-based)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0989 Chakra Scripting Engine Memory Corruption Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Edge (EdgeHTML-based)
vendor: Microsoft
product: ChakraCore
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.2
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0990 Chakra Scripting Engine Memory Corruption Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: ChakraCore
vendor: Microsoft
product: Microsoft Edge (EdgeHTML-based)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0991 Chakra Scripting Engine Memory Corruption Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Edge (EdgeHTML-based)
vendor: Microsoft
product: ChakraCore
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.2
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0992 Chakra Scripting Engine Memory Corruption Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Edge (EdgeHTML-based)
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.2
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0993 Chakra Scripting Engine Memory Corruption Vulnerability
Problem types: description: Remote Code Execution
Affected products: vendor: Microsoft
product: Microsoft Edge (EdgeHTML-based)
vendor: Microsoft
product: ChakraCore
CVSS v3.1: version: 3.1
baseSeverity: MEDIUM
baseScore: 4.2
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0995 
A security feature bypass vulnerability exists when urlmon.dll improperly handles certain Mark of the Web queries, aka 'Internet Explorer Security Feature Bypass Vulnerability'.
Problem types: description: Security Feature Bypass
Affected products: vendor: Microsoft
product: Internet Explorer 11
vendor: Microsoft
product: Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems
vendor: Microsoft
product: Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems
vendor: Microsoft
product: Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems
Published: 2019-05-16T18:24:57.000Z
CVE-2019-0996 Azure DevOps Server Spoofing Vulnerability
Problem types: description: Spoofing
Affected products: vendor: Microsoft
product: Azure DevOps Server 2019
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0998 Windows Storage Service Elevation of Privilege Vulnerability
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows 10 Version 1803
vendor: Microsoft
product: Windows Server, version 1803  (Server Core Installation)
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows 10 Version 1809
vendor: Microsoft
product: Windows Server 2019
vendor: Microsoft
product: Windows Server 2019 (Server Core installation)
vendor: Microsoft
product: Windows 10 Version 1709 for 32-bit Systems
vendor: Microsoft
product: Windows 10 Version 1709
vendor: Microsoft
product: Windows 10 Version 1903 for 32-bit Systems
vendor: Microsoft
product: Windows 10 Version 1903 for x64-based Systems
vendor: Microsoft
product: Windows 10 Version 1903 for ARM64-based Systems
vendor: Microsoft
product: Windows Server, version 1903 (Server Core installation)
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Published: 2019-06-12T13:49:39.000Z
CVE-2019-0999 
An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.
Problem types: description: Elevation of Privilege
Affected products: vendor: Microsoft
product: Windows
vendor: Microsoft
product: Windows Server
Published: 2019-07-15T18:56:19.000Z
CVE-2019-1000001 
TeamPass version 2.1.27 and earlier contains a Storing Passwords in a Recoverable Format vulnerability in Shared password vaults that can result in all shared passwords are recoverable server side. This attack appears to be exploitable via any vulnerability that can bypass authentication or role assignment and can lead to shared password leakage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000002 
Gitea version 1.6.2 and earlier contains a Incorrect Access Control vulnerability in Delete/Edit file functionallity that can result in the attacker deleting files outside the repository he/she has access to. This attack appears to be exploitable via the attacker must get write access to "any" repository including self-created ones.. This vulnerability appears to have been fixed in 1.6.3, 1.7.0-rc2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000003 
MapSVG MapSVG Lite version 3.2.3 contains a Cross Site Request Forgery (CSRF) vulnerability in REST endpoint /wp-admin/admin-ajax.php?action=mapsvg_save that can result in an attacker can modify post data, including embedding javascript. This attack appears to be exploitable via the victim must be logged in to WordPress as an admin, and click a link. This vulnerability appears to have been fixed in 3.3.0 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000004 
yugandhargangu JspMyAdmin2 version 1.0.6 and earlier contains a Cross Site Scripting (XSS) vulnerability in sidebar and table data that can result in Database fields aren't properly sanitized and allow code injection (Cross-Site Scripting). This attack appears to be exploitable via the payload needs to be stored in the database and the victim must see the db value in question.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000005 
mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content <img src="phar://path/to/crafted/image">. This vulnerability appears to have been fixed in 7.1.8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000006 
RIOT RIOT-OS version after commit 7af03ab624db0412c727eed9ab7630a5282e2fd3 contains a Buffer Overflow vulnerability in sock_dns, an implementation of the DNS protocol utilizing the RIOT sock API that can result in Remote code executing. This attack appears to be exploitable via network connectivity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000007 
aioxmpp version 0.10.2 and earlier contains a Improper Handling of Structural Elements vulnerability in Stanza Parser, rollback during error processing, aioxmpp.xso.model.guard function that can result in Denial of Service, Other. This attack appears to be exploitable via Remote. A crafted stanza can be sent to an application which uses the vulnerable components to either inject data in a different context or cause the application to reconnect (potentially losing data). This vulnerability appears to have been fixed in 0.10.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000008 
All versions of Helm between Helm >=2.0.0 and < 2.12.2 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The commands `helm fetch --untar` and `helm lint some.tgz` that can result when chart archive files are unpacked a file may be unpacked outside of the target directory. This attack appears to be exploitable via a victim must run a helm command on a specially crafted chart archive. This vulnerability appears to have been fixed in 2.12.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000009 
Helm ChartMuseum version >=0.1.0 and < 0.8.1 contains a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HTTP API to save charts that can result in a specially crafted chart could be uploaded and saved outside the intended location. This attack appears to be exploitable via A POST request to the HTTP API can save a chart archive outside of the intended directory. If authentication is, optionally, enabled this requires an authorized user to do so. This vulnerability appears to have been fixed in 0.8.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000010 
phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000011 
API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000012 
Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.19.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000013 
Hex package manager hex_core version 0.3.0 and earlier contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 0.4.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000014 
Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000015 
Chamilo Chamilo-lms version 1.11.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in main/messages/new_message.php, main/social/personal_data.php, main/inc/lib/TicketManager.php, main/ticket/ticket_details.php that can result in a message being sent to the Administrator with the XSS to steal cookies. A ticket can be created with a XSS payload in the subject field. This attack appears to be exploitable via <svg/onload=alert(1)> as the payload user on the Subject field. This makes it possible to obtain the cookies of all users that have permission to view the tickets. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000016 
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbs_av1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in after commit b97a4b658814b2de8b9f2a3bce491c002d34de31.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000017 
Chamilo Chamilo-lms version 1.11.8 and earlier contains an Incorrect Access Control vulnerability in Tickets component that can result in an authenticated user can read all tickets available on the platform, due to lack of access controls. This attack appears to be exploitable via ticket_id=[ticket number]. This vulnerability appears to have been fixed in 1.11.x after commit 33e2692a37b5b6340cf5bec1a84e541460983c03.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000018 
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000019 
libarchive version commit bf9aec176c6748f0ee7a678c5f9f9555b9a757c1 onwards (release v3.0.2 onwards) contains a CWE-125: Out-of-bounds Read vulnerability in 7zip decompression, archive_read_support_format_7zip.c, header_bytes() that can result in a crash (denial of service). This attack appears to be exploitable via the victim opening a specially crafted 7zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000020 
libarchive version commit 5a98dcf8a86364b3c2c469c85b93647dfb139961 onwards (version v2.8.0 onwards) contains a CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in ISO9660 parser, archive_read_support_format_iso9660.c, read_CE()/parse_rockridge() that can result in DoS by infinite loop. This attack appears to be exploitable via the victim opening a specially crafted ISO9660 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000021 
slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000022 
Taoensso Sente version Prior to version 1.14.0 contains a Cross Site Request Forgery (CSRF) vulnerability in WebSocket handshake endpoint that can result in CSRF attack, possible leak of anti-CSRF token. This attack appears to be exploitable via malicious request against WebSocket handshake endpoint. This vulnerability appears to have been fixed in 1.14.0 and later.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000023 
OPT/NET BV OPTOSS Next Gen Network Management System (NG-NetMS) version v3.6-2 and earlier versions contains a SQL Injection vulnerability in Identified vulnerable parameters: id, id_access_type and id_attr_access that can result in a malicious attacker can include own SQL commands which database will execute. This attack appears to be exploitable via network connectivity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000024 
OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting (XSS) vulnerability in /js/libs/jstree/demo/filebrowser/index.php page. The "id" and "operation" GET parameters can be used to inject arbitrary JavaScript which is returned in the page's response that can result in Cross-site scripting.This attack appear to be exploitable via network connectivity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-04T21:00:00.000Z
CVE-2019-1000031 
A disk space or quota exhaustion issue exists in article2pdf_getfile.php in the article2pdf Wordpress plugin 0.24, 0.25, 0.26, 0.27. Visiting PDF generation link but not following the redirect will leave behind a PDF file on disk which will never be deleted by the plug-in.
Problem types: description: disk consumption
Affected products: vendor: article2pdf
product: article2pdf Wordpress plug-in
Published: 2019-03-27T17:55:00.000Z
CVE-2019-1002100 
In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.
Problem types: description: Uncontrolled Resource Consumption
Affected products: vendor: Kubernetes
product: Kubernetes
Credits: lang: en
value: Reported by Carl Henrik Lunde
Published: 2019-04-01T14:14:27.000Z