rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-12145 Silver Peak Unity OrchestratorTM authentication can be subverted through manipulation of HTTP headers.
Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+ uses HTTP headers to authenticate REST API calls from localhost. This makes it possible to log in to Orchestrator by introducing an HTTP HOST header set to 127.0.0.1 or localhost. Orchestrator instances that are hosted by customers –on-premise or in a public cloud provider –are affected by this vulnerability.
Problem types: description: CVE-2020-12145
cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Silver Peak Systems, Inc.
product: Unity Orchestrator
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by the security team at Realmode Labs.
Published: 2020-11-05T18:48:31.021Z
CVE-2020-12146 Silver Peak Unity OrchestratorTM subject to path traversal.
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can access, modify, and delete restricted files on the Orchestrator server using the/debugFiles REST API.
Problem types: description: CVE-2020-12147
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Silver Peak Systems, Inc.
product: Unity Orchestrator
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by the security team at Realmode Labs.
Published: 2020-11-05T18:51:45.101Z
CVE-2020-12147 Unauthorized queries against the Silver Peak Unity OrchestratorTM MySQL database.
In Silver Peak Unity Orchestrator versions prior to 8.9.11+, 8.10.11+, or 9.0.1+, an authenticated user can make unauthorized MySQL queries against the Orchestrator database using the /sqlExecution REST API, which had been used for internal testing.
Problem types: description: CVE-2020-12147
cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Silver Peak Systems, Inc.
product: Unity Orchestrator
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by the security team at Realmode Labs.
Published: 2020-11-05T18:50:21.332Z
CVE-2020-12148 OS Command Injection - nslookup API
A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM (ECOS) appliance software could allow an attacker to execute arbitrary commands with the privileges of the web server running on the EdgeConnect appliance. An attacker could exploit this vulnerability to establish an interactive channel, effectively taking control of the target system. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to : 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Silver Peak Systems, Inc.
product: ECOS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by Alexander Smye and Jonathan Letham from the security team at NCC Group.
Published: 2020-12-11T15:24:23.056Z
CVE-2020-12149 OS Command Injection - Management File Upload
The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to: 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Silver Peak Systems, Inc.
product: ECOS
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: This vulnerability was reported to Silver Peak by Alexander Smye and Jonathan Letham from the security team at NCC Group.
Published: 2020-12-11T15:23:32.991Z
CVE-2020-12242 
Valve Source allows local users to gain privileges by writing to the /tmp/hl2_relaunch file, which is later executed in the context of a different user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:56:12.000Z
CVE-2020-12243 
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T18:07:29.000Z
CVE-2020-12244 
An issue has been found in PowerDNS Recursor 4.1.0 through 4.3.0 where records in the answer section of a NXDOMAIN response lacking an SOA were not properly validated in SyncRes::processAnswer, allowing an attacker to bypass DNSSEC validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-19T13:51:39.000Z
CVE-2020-12245 
Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-24T20:24:48.000Z
CVE-2020-12246 
Beeline Smart Box 2.0.38 routers allow "Advanced settings > Other > Diagnostics" OS command injection via the Ping ping_ipaddr parameter, the Nslookup nslookup_ipaddr parameter, or the Traceroute traceroute_ipaddr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T12:34:24.000Z
CVE-2020-12247 
In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can obtain sensitive information from an out-of-bounds read because a text-string index continues to be used after splitting a string into two parts. A crash may also occur.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-04T03:32:00.000Z
CVE-2020-12248 
In Foxit Reader and PhantomPDF before 10.0.1, and PhantomPDF before 9.7.3, attackers can execute arbitrary code via a heap-based buffer overflow because dirty image-resource data is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-04T03:32:41.000Z
CVE-2020-12251 
An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an authenticated user to change the filename value (in the POST method) from the original filename to achieve directory traversal via a ../ sequence and, for example, obtain a complete directory listing of the machine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:02:36.000Z
CVE-2020-12252 
An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an arbitrary file upload for an authenticated user. If an executable file is uploaded into the www-root directory, then it could yield remote code execution via the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T13:03:47.000Z
CVE-2020-12254 
Avira Antivirus before 5.0.2003.1821 on Windows allows privilege escalation or a denial of service via abuse of a symlink.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-26T14:52:24.000Z
CVE-2020-12255 
rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus, an attacker can exploit this by uploading a .php file to vendor.php that contains arbitrary PHP code and changing the content-type to image/gif.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T14:05:12.000Z
CVE-2020-12256 
rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T14:03:51.000Z
CVE-2020-12257 
rConfig 3.9.4 is vulnerable to cross-site request forgery (CSRF) because it lacks implementation of CSRF protection such as a CSRF token. An attacker can leverage this vulnerability by creating a form (add a user, delete a user, or edit a user).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T13:51:57.000Z
CVE-2020-12258 
rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T13:01:57.000Z
CVE-2020-12259 
rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-05-18T13:00:17.000Z
CVE-2020-12261 
Open-AudIT 3.3.0 allows an XSS attack after login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T21:12:05.000Z
CVE-2020-12262 
Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 devices allow /cgi-bin/cgiServer.exx?page= XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-26T23:41:04.000Z
CVE-2020-12265 
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-26T16:46:21.000Z
CVE-2020-12266 
An issue was discovered where there are multiple externally accessible pages that do not require any sort of authentication, and store system information for internal usage. The devices automatically query these pages to update dashboards and other statistics, but the pages can be accessed externally without any authentication. All the pages follow the naming convention live_(string).shtml. Among the information disclosed is: interface status logs, IP address of the device, MAC address of the device, model and current firmware version, location, all running processes, all interfaces and their statuses, all current DHCP leases and the associated hostnames, all other wireless networks in range of the router, memory statistics, and components of the configuration of the device such as enabled features. Affected devices: Affected devices are: Wavlink WN530HG4, Wavlink WN575A3, Wavlink WN579G3,Wavlink WN531G3, Wavlink WN533A8, Wavlink WN531A6, Wavlink WN551K1, Wavlink WN535G3, Wavlink WN530H4, Wavlink WN57X93, WN572HG3, Wavlink WN578A2, Wavlink WN579G3, Wavlink WN579X3, and Jetstream AC3000/ERAC3000
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T14:33:49.000Z
CVE-2020-12267 
setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextMarkdownImporter::insertBlock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T01:31:42.000Z
CVE-2020-12268 
jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 has a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T01:44:05.000Z
CVE-2020-12270 
React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it was a false alert if contact-history comparison fails (i.e., an F0 is not actually part of the contact history obtained from the device of this recipient, or this recipient is not actually part of the contact history obtained from the device of an F0)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T03:26:40.000Z
CVE-2020-12271 
A SQL injection issue was found in SFOS 17.0, 17.1, 17.5, and 18.0 before 2020-04-25 on Sophos XG Firewall devices, as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access (but not external Active Directory or LDAP passwords)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T04:00:01.000Z
CVE-2020-12272 
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about the domain that originated an e-mail message. This is caused by incorrect parsing and interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T00:00:00.000Z
CVE-2020-12273 
In TestLink 1.9.20, a crafted login.php viewer parameter exposes cleartext credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T12:35:07.000Z
CVE-2020-12274 
In TestLink 1.9.20, the lib/cfields/cfieldsExport.php goback_url parameter causes a security risk because it depends on client input and is not constrained to lib/cfields/cfieldsView.php at the web site associated with the session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T12:34:54.000Z
CVE-2020-12275 
GitLab 12.6 through 12.9 is vulnerable to a privilege escalation that allows an external user to create a personal snippet through the API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T16:28:23.000Z
CVE-2020-12276 
GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T16:28:21.000Z
CVE-2020-12277 
GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-29T16:28:18.000Z
CVE-2020-12278 
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T00:00:00.000Z
CVE-2020-12279 
An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-27T00:00:00.000Z
CVE-2020-12280 
iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/gate via /isg/opendoor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T15:01:38.000Z
CVE-2020-12281 
iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T15:06:42.000Z
CVE-2020-12282 
iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. (This can be combined with reflected XSS.)
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-24T15:10:45.000Z
CVE-2020-12283 
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-30T04:07:29.000Z
CVE-2020-12284 
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T05:16:43.000Z
CVE-2020-12286 
In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the TaskView permission is not scoped to any dimension. For example, a scoped user who is scoped to only one tenant can view server tasks scoped to any other tenant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-28T06:06:24.000Z
CVE-2020-12287 
Incorrect permissions in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2020.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Distribution of OpenVINO(TM) Toolkit Advisory
Published: 2020-08-13T02:11:15.000Z
CVE-2020-12288 
Protection mechanism failure in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:42:44.000Z
CVE-2020-12289 
Out-of-bounds write in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:42:50.000Z
CVE-2020-12290 
Improper access control in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:42:38.000Z
CVE-2020-12291 
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:37:54.000Z
CVE-2020-12292 
Improper conditions check in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:42:29.000Z
CVE-2020-12293 
Improper control of a resource through its lifetime in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:37:28.000Z
CVE-2020-12294 
Insufficient control flow management in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:37:35.000Z
CVE-2020-12295 
Improper input validation in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:37:41.000Z
CVE-2020-12296 
Uncontrolled resource consumption in some Intel(R) Thunderbolt(TM) controllers may allow an authenticated user to potentially enable denial of service via local access.
Problem types: description: denial of service
Affected products: vendor: n/a
product: Intel(R) Thunderbolt(TM) controllers
Published: 2021-06-09T18:37:48.000Z
CVE-2020-12297 
Improper access control in Installer for Intel(R) CSME Driver for Windows versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access.
Problem types: description: escalation of privileges
Affected products: vendor: n/a
product: Intel(R) CSME, Intel TXE
Published: 2020-11-12T18:05:39.000Z
CVE-2020-12299 
Improper input validation in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Server Board Families Advisory
Published: 2020-08-13T03:26:55.000Z
CVE-2020-12300 
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Server Board Families Advisory
Published: 2020-08-13T03:25:52.000Z
CVE-2020-12301 
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
Affected products: vendor: n/a
product: Intel(R) Server Board Families Advisory
Published: 2020-08-13T03:26:30.000Z