yahoo-inc/cve-impacts huggingface dataset:
CVE-2019-14437: The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2019-14438: A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file.
Key phrases: trigger a heap-based buffer over-, heap-based buffer over-read, buffer over read
CVE-2019-14439: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Key phrases: polymorphic typing issue
CVE-2019-14441: An issue was discovered in Libav 12.3. An access violation allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv. This is related to ff_mpa_synth_filter_float in avcodec/mpegaudiodsp_template.c. NOTE: This may be a duplicate of CVE-2018-19129
Key phrases: denial of service (application crash), cause a denial of service (application crash, access violation
CVE-2019-14442: In mpc8_read_header in libavformat/mpc8.c in Libav 12.3, an input file can result in an avio_seek infinite loop and hang, with 100% CPU consumption. Attackers could leverage this vulnerability to cause a denial of service via a crafted file.
Key phrases: avio_seek infinite loop, denial of service, hang
CVE-2019-14443: An issue was discovered in Libav 12.3. Division by zero in range_decode_culshift in libavcodec/apedec.c allows remote attackers to cause a denial of service (application crash), as demonstrated by avconv.
Key phrases: denial of service (application crash), cause a denial of service (application crash, division by zero
CVE-2019-14444: apply_relocations in readelf.c in GNU Binutils 2.32 contains an integer overflow that allows attackers to trigger a write access violation (in byte_put_little_endian function in elfcomm.c) via an ELF file, as demonstrated by readelf.
Key phrases: trigger a write access violation (in byte_put_little_endian, integer overflow
CVE-2019-14449: An issue was discovered in Cloudera Manager 5.x before 5.16.2, 6.0.x before 6.0.2, and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.
Key phrases: cross site scripting (xss)
CVE-2019-1445: A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1447.
Key phrases: spoofing, microsoft office online spoofing
CVE-2019-14450: A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart.
Key phrases: for the creation of a user controlled XML, directory traversal, remote code execution, reboot
CVE-2019-14451: RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart.
Key phrases: remote code execution, reboot
CVE-2019-14452: Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.
Key phrases: write arbitrary files, write arbitrary files via a ../ (, directory traversal
CVE-2019-14453: An issue was discovered in Comelit "App lejos de casa (web)" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges (installer or administrator) for the graphical interface via a 1C000000000S value for domus, in conjunction with a zero value for logged.
Key phrases: js/bridge.min.js and login.json, privilege escalation
CVE-2019-14454: SuiteCRM 7.11.x and 7.10.x before 7.11.8 and 7.10.20 is vulnerable to vertical privilege escalation.
Key phrases: vertical privilege escalation
CVE-2019-14456: Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server) sends crafted text to a serial port (that has logging enabled), the text will be replayed when the logs are viewed. Exploiting this vulnerability requires access to the serial port and/or console server.
Key phrases: xss
CVE-2019-14457: VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2019-14458: VIVOTEK IP Camera devices with firmware before 0x20x allow a denial of service via a crafted HTTP header.
Key phrases: a denial of service via a crafted HTTP
CVE-2019-14459: nfdump 1.6.17 and earlier is affected by an integer overflow in the function Process_ipfix_template_withdraw in ipfix.c that can be abused in order to crash the process remotely (denial of service).
Key phrases: integer overflow, denial of service, crash
CVE-2019-1446: An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
Key phrases: information disclosure, microsoft excel information disclosure
CVE-2019-14462: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_COILS case, aka VD-1302.
Key phrases: out-of-bounds read, out of bounds read
CVE-2019-14463: An issue was discovered in libmodbus before 3.0.7 and 3.1.x before 3.1.5. There is an out-of-bounds read for the MODBUS_FC_WRITE_MULTIPLE_REGISTERS case, aka VD-1301.
Key phrases: out-of-bounds read, out of bounds read
CVE-2019-14464: XMFile::read in XMFile.cpp in milkyplay in MilkyTracker 1.02.00 has a heap-based buffer overflow.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2019-14465: fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-based buffer overflow.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2019-14466: The GOsa_Filter_Settings cookie in GONICUS GOsa 2.7.5.2 is vulnerable to PHP objection injection, which allows a remote authenticated attacker to perform file deletions (in the context of the user account that runs the web server) via a crafted cookie value, because unserialize is used to restore filter settings from a cookie.
Key phrases: perform file deletions (in the context of, php objection injection
CVE-2019-14467: The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album, because the file extension is not checked.
Key phrases: Remote Code Execution by creating an album and, remote code execution
CVE-2019-14468: GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c via crafted COBOL source code.
Key phrases: buffer overflow
CVE-2019-14469: In Nexus Repository Manager before 3.18.0, users with elevated privileges can create stored XSS.
Key phrases: stored xss
CVE-2019-1447: A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications handlers correctly, aka 'Microsoft Office Online Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-1445.
Key phrases: spoofing, microsoft office online spoofing
CVE-2019-14470: cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.
Key phrases: xss
CVE-2019-14471: TestLink 1.9.19 has XSS via the error.php message parameter.
Key phrases: xss
CVE-2019-14472: Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
Key phrases: xss
CVE-2019-14473: eQ-3 Homematic CCU2 and CCU3 use session IDs for authentication but lack authorization checks. Consequently, a valid guest level or user level account can create a new admin level account, read the service messages, clear the system protocol or modify/delete internal programs, etc. pp.
Key phrases: authorization checks
CVE-2019-14474: eQ-3 Homematic CCU3 3.47.15 and prior has Improper Input Validation in function 'Call()' of ReGa core logic process, resulting in the ability to start a Denial of Service. Due to Improper Authorization an attacker can obtain a session ID from CVE-2019-9583 or a valid guest/user/admin account can start this attack too.
Key phrases: obtain a session ID from CVE-2019-9583, improper input validation, denial of service, improper authorization
CVE-2019-14475: eQ-3 Homematic CCU2 2.47.15 and prior and CCU3 3.47.15 and prior use session IDs for authentication but lack authorization checks. An attacker can obtain a session ID from CVE-2019-9583, resulting in the ability to read the service messages, clear the system protocol, create a new user in the system, or modify/delete internal programs.
Key phrases: obtain a session ID from CVE-2019-9583
CVE-2019-14476: AdRem NetCrunch 10.6.0.4587 has a Server-Side Request Forgery (SSRF) vulnerability in the NetCrunch server. Every user can trick the server into performing SMB requests to other systems.
Key phrases: server-side request forgery (ssrf)
CVE-2019-14477: AdRem NetCrunch 10.6.0.4587 has Improper Credential Storage since the internal user database is readable by low-privileged users and passwords in the database are weakly encoded or encrypted.
Key phrases: improper credential storage
CVE-2019-14478: AdRem NetCrunch 10.6.0.4587 has a stored Cross-Site Scripting (XSS) vulnerability in the NetCrunch web client. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript code in the context of the user's browser if the victim opens or searches for a node whose "Display Name" contains an XSS payload.
Key phrases: execute JavaScript code in the context of the, cross-site scripting (xss)
CVE-2019-14479: AdRem NetCrunch 10.6.0.4587 allows Remote Code Execution. In the NetCrunch web client, a read-only administrator can execute arbitrary code on the server running the NetCrunch server software.
Key phrases: execute arbitrary code, Remote Code Execution, remote code execution
CVE-2019-1448: A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.
Key phrases: remote code execution, microsoft excel remote code execution
CVE-2019-14480: AdRem NetCrunch 10.6.0.4587 has an Improper Session Handling vulnerability in the NetCrunch web client, which can lead to an authentication bypass or escalation of privileges.
Key phrases: bypass or escalation of privileges, authentication bypass, improper session handling, escalation privilege
CVE-2019-14481: AdRem NetCrunch 10.6.0.4587 has a Cross-Site Request Forgery (CSRF) vulnerability in the NetCrunch web client. Successful exploitation requires a logged-in user to open a malicious page and leads to account takeover.
Key phrases: cross-site request forgery (csrf), account takeover
CVE-2019-14482: AdRem NetCrunch 10.6.0.4587 has a hardcoded SSL private key vulnerability in the NetCrunch web client. The same hardcoded SSL private key is used across different customers' installations when no other SSL certificate is installed, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Key phrases: defeat cryptographic protection mechanisms by leveraging knowledge of, hardcoded ssl private key
CVE-2019-14483: AdRem NetCrunch 10.6.0.4587 allows Credentials Disclosure. Every user can read the BSD, Linux, MacOS and Solaris private keys, private keys' passwords, and root passwords stored in the credential manager. Every administrator can read the ESX and Windows passwords stored in the credential manager.
Key phrases: Credentials Disclosure, credentials disclosure
CVE-2019-14486: GnuCOBOL 2.2 has a buffer overflow in cb_evaluate_expr in cobc/field.c via crafted COBOL source code.
Key phrases: buffer overflow
CVE-2019-1449: A security feature bypass vulnerability exists in the way that Office Click-to-Run (C2R) components handle a specially crafted file, which could lead to a standard user, any AppContainer sandbox, and Office LPAC Protected View to escalate privileges to SYSTEM.To exploit this bug, an attacker would have to run a specially crafted file, aka 'Microsoft Office ClickToRun Security Feature Bypass Vulnerability'.
Key phrases: security feature bypass, microsoft office clicktorun security feature bypass, feature bypass,, escalate privilege
CVE-2019-14491: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Key phrases: out of bounds read, denial of service
CVE-2019-14492: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1. There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Key phrases: out of bounds read write, denial of service
CVE-2019-14493: An issue was discovered in OpenCV before 4.1.1. There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.
Key phrases: null pointer dereference
CVE-2019-14494: An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.
Key phrases: divide-by-zero error
CVE-2019-14495: webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write in the admin interface.
Key phrases: out-of-bounds write, out of bounds write
CVE-2019-14496: LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2019-14497: ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2019-14498: A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted CAF file.
Key phrases: fpe
CVE-2019-14510: An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client is a Domain Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the domain BUILTIN\\\\Administrators group. Using the well known Pass-the-Hash techniques, an attacker can use the same FSAdminxxxxxxxxx hash from any LAN Cache client and pass this to a Domain Controller, providing administrative rights to the attacker on any Domain Controller. (Local account Pass-the-Hash mitigations do not protect domain accounts.)
Key phrases: pass-the-hash techniques
CVE-2019-14511: Sphinx Technologies Sphinx 3.1.1 by default has no authentication and listens on 0.0.0.0, making it exposed to the internet (unless filtered by a firewall or reconfigured to listen to 127.0.0.1 only).
Key phrases: exposed to the internet
CVE-2019-14512: LimeSurvey 3.17.7+190627 has XSS via Boxes in application/extensions/PanelBoxWidget/views/box.php or a label title in application/views/admin/labels/labelview_view.php.
Key phrases: xss
CVE-2019-14513: Improper bounds checking in Dnsmasq before 2.76 allows an attacker controlled DNS server to send large DNS packets that result in a read operation beyond the buffer allocated for the packet, a different vulnerability than CVE-2017-14491.
Key phrases: send large DNS packets that result in a, improper bounds checking
CVE-2019-14514: An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup (this is unrelated to Red Hat's systemd init program, and is a closed-source proprietary tool that seems to be developed by Microvirt). This program opens TCP port 21509, presumably to receive installation-related commands from the host OS. Because everything after the installer:uninstall command is concatenated directly into a system() call, it is possible to execute arbitrary commands by supplying shell metacharacters.
Key phrases: execute arbitrary commands, shell metacharacters, root privilege
CVE-2019-14516: The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation, leading to man-in-the-middle attacks against requests for FAQs or Help.
Key phrases: ssl certificate validation, man in the middle
CVE-2019-14517: pandao Editor.md 1.5.0 allows XSS via the Javas&#99;ript: string.
Key phrases: XSS via the Javas&#99;ript: string, xss
CVE-2019-14518: Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the "access policy in the administration panel.
Key phrases: XSS via a description and new category location, xss
CVE-2019-14521: The api/admin/logoupload Logo File upload feature in EMCA Energy Logserver 6.1.2 allows attackers to send any kind of file to any location on the server via path traversal in the filename parameter.
Key phrases: send any kind of file to any location, path traversal
CVE-2019-14523: An issue was discovered in Schism Tracker through 20190722. There is an integer underflow via a large plen in fmt_okt_load_song in the Amiga Oktalyzer parser in fmt/okt.c.
Key phrases: integer underflow
CVE-2019-14524: An issue was discovered in Schism Tracker through 20190722. There is a heap-based buffer overflow via a large number of song patterns in fmt_mtm_load_song in fmt/mtm.c, a different vulnerability than CVE-2019-14465.
Key phrases: heap-based buffer overflow, song patterns, heap based buffer overflow
CVE-2019-14525: In Octopus Deploy 2019.4.0 through 2019.6.x before 2019.6.6, and 2019.7.x before 2019.7.6, an authenticated system administrator is able to view sensitive values by visiting a server configuration page or making an API call.
Key phrases: sensitive values
CVE-2019-14526: An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. The web-interface Cross-Site Request Forgery token is stored in a dynamically generated JavaScript file, and therefore can be embedded in third party pages, and re-used against the Nighthawk web interface. This entirely bypasses the intended security benefits of the use of a CSRF-protection token.
Key phrases: cross-site request forgery token
CVE-2019-14527: An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authentication.
Key phrases: system commands
CVE-2019-14528: GnuCOBOL 2.2 has a heap-based buffer overflow in read_literal in cobc/scanner.l via crafted COBOL source code.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2019-14529: OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eye_mag/save.php.
Key phrases: SQL Injection in interface/forms/eye_mag, sql injection
CVE-2019-1453: A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability'.
Key phrases: denial of service, windows remote desktop protocol (rdp) denial of service
CVE-2019-14530: An issue was discovered in custom/ajax_download.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file (that is readable by the user www-data) from server storage. If the requested file is writable for the www-data user and the directory /var/www/openemr/sites/default/documents/cqm_qrda/ exists, it will be deleted from server.
Key phrases: deleted
CVE-2019-14531: An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an out of bounds read on iso9660 while parsing System Use Sharing Protocol data in fs/iso9660.c.
Key phrases: out of bounds read
CVE-2019-14532: An issue was discovered in The Sleuth Kit (TSK) 4.6.6. There is an off-by-one overwrite due to an underflow on tools/hashtools/hfind.cpp while using a bogus hash table.
Key phrases: off-by-one overwrite, underflow
CVE-2019-14533: The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.
Key phrases: use-after-free, use after free
CVE-2019-14534: In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack.
Key phrases: null pointer dereference, denial of service
CVE-2019-14535: A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted WMV file.
Key phrases: fpe
CVE-2019-14537: YOURLS through 1.7.3 is affected by a type juggling vulnerability in the api component that can result in login bypass.
Key phrases: login bypass, type juggling
CVE-2019-1454: An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks, aka 'Windows User Profile Service Elevation of Privilege Vulnerability'.
Key phrases: elevation of privilege, windows user profile service elevation of privilege, elevation privilege
CVE-2019-14540: A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
Key phrases: polymorphic typing issue
CVE-2019-14541: GnuCOBOL 2.2 has a stack-based buffer overflow in cb_encode_program_id in cobc/typeck.c via crafted COBOL source code.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2019-14544: routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
CVE-2019-14546: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature, which fires when the victim replies or forwards the mail, thus helping him steal victims' cookies (hence compromising their accounts).
Key phrases: stored xss, malicious payload, compromising their accounts
CVE-2019-14547: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users, thus helping him steal victims' cookies (hence compromising their accounts).
Key phrases: stored xss, compromising their accounts
CVE-2019-14548: An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article, thus helping him steal victims' cookies (hence compromising their accounts).
Key phrases: stored xss, compromising their accounts
CVE-2019-14549: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible link.
Key phrases: stored xss
CVE-2019-14550: An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature, which would fire when a user clicks on the Edit Dashboard button, thus helping him steal victims' cookies (hence compromising their accounts).
Key phrases: stored xss, compromising their accounts
CVE-2019-14551: Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines, as demonstrated by a cross-origin /install request with an attacker-controlled releaseUrl, which triggers download and execution of code within a ZIP archive.
Key phrases: execute arbitrary code, execute arbitrary code on client machines, cross-origin install request
CVE-2019-14553: Improper authentication in EDK II may allow a privileged user to potentially enable information disclosure via network access.
Key phrases: potentially enable information disclosure via network access, improper authentication
CVE-2019-14556: Improper initialization in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper initialization
CVE-2019-14557: Buffer overflow in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable elevation of privilege or denial of service via adjacent access.
Key phrases: potentially enable elevation of privilege or denial of, buffer overflow, denial of service, elevation privilege
CVE-2019-14558: Insufficient control flow management in BIOS firmware for 8th, 9th, 10th Generation Intel(R) Core(TM), Intel(R) Celeron(R) Processor 4000 & 5000 Series Processors may allow an authenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, insufficient control flow management
CVE-2019-14559: Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, uncontrolled resource consumption
CVE-2019-1456: A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts, aka 'OpenType Font Parsing Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1419.
Key phrases: remote code execution
CVE-2019-14562: Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, integer overflow
CVE-2019-14563: Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, integer truncation, escalation privilege
CVE-2019-14565: Insufficient initialization in Intel(R) SGX SDK Windows versions 2.4.100.51291 and earlier, and Linux versions 2.6.100.51363 and earlier, may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.
Key phrases: enable information disclosure, insufficient initialization, escalation of privilege, denial of service, local access, escalation privilege
CVE-2019-14566: Insufficient input validation in Intel(R) SGX SDK multiple Linux and Windows versions may allow an authenticated user to enable information disclosure, escalation of privilege or denial of service via local access.
Key phrases: enable information disclosure, insufficient input validation, escalation of privilege, denial of service, local access, escalation privilege
CVE-2019-14568: Improper permissions in the executable for Intel(R) RST before version 17.7.0.1006 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper permissions, escalation privilege
CVE-2019-14569: Pointer corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Key phrases: potentially enable escalation of privilege, pointer corruption, denial of service, information disclosure, local access, escalation privilege
CVE-2019-1457: A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel Security Feature Bypass'.
Key phrases: Bypass', security feature bypass, microsoft office excel security feature bypass, feature bypass,
CVE-2019-14570: Memory corruption in system firmware for Intel(R) NUC may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access.
Key phrases: potentially enable escalation of privilege, memory corruption, denial of service, information disclosure, local access, escalation privilege
CVE-2019-14574: Out of bounds read in a subsystem for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, out of bounds read
CVE-2019-14575: Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, logic issue, escalation privilege
CVE-2019-1458: An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
Key phrases: elevation of privilege, elevation privilege
CVE-2019-14584: Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, null pointer dereference, escalation privilege
CVE-2019-14586: Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent access.
Key phrases: potentially enable escalation of privilege, use after free, information disclosure, denial of service, escalation privilege
CVE-2019-14587: Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, logic issue edk ii
CVE-2019-14590: Improper access control in the API for the Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper access control
CVE-2019-14591: Improper input validation in the API for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper input validation
CVE-2019-14596: Improper access control in the installer for Intel(R) Chipset Device Software INF Utility before version 10.1.18 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2019-14598: Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access.
Key phrases: potentially enable escalation of privilege, improper authentication, denial of service, information disclosure, local access, escalation privilege
CVE-2019-14599: Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, unquoted service path, escalation privilege
CVE-2019-1460: A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook for Android Spoofing Vulnerability'.
Key phrases: spoofing, outlook for android spoofing
CVE-2019-14600: Uncontrolled search path element in the installer for Intel(R) SNMP Subagent Stand-Alone for Windows* may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path element, escalation privilege
CVE-2019-14601: Improper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper permissions, escalation privilege
CVE-2019-14602: Improper permissions in the installer for the Nuvoton* CIR Driver versions 1.02.1002 and before may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper permissions, escalation privilege
CVE-2019-14603: Improper permissions in the installer for the License Server software for Intel Quartus Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper permissions, escalation privilege
CVE-2019-14604: Null pointer dereference in the FPGA kernel driver for Intel(R) Quartus(R) Prime Pro Edition before version 19.3 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, null pointer dereference
CVE-2019-14605: Improper permissions in the installer for the Intel(R) SCS Platform Discovery Utility, all versions, may allow an authenticated user to potentially enable escalation of privilege via local attack.
Key phrases: potentially enable escalation of privilege via local attack, improper permissions, escalation privilege
CVE-2019-14607: Improper conditions check in multiple Intel Processors may allow an authenticated user to potentially enable partial escalation of privilege, denial of service and/or information disclosure via local access.
Key phrases: potentially enable partial escalation of privilege, improper conditions check, denial of service, information disclosure, local access, escalation privilege
CVE-2019-14608: Improper buffer restrictions in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper buffer restrictions, escalation privilege
CVE-2019-14609: Improper input validation in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2019-1461: A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of Service Vulnerability'.
Key phrases: denial of service, microsoft word denial of service
CVE-2019-14610: Improper access control in firmware for Intel(R) NUC(R) may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2019-14611: Integer overflow in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, integer overflow, escalation privilege
CVE-2019-14612: Out of bounds write in firmware for Intel(R) NUC(R) may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, out of bounds write, escalation privilege
CVE-2019-14613: Improper access control in driver for Intel(R) VTune(TM) Amplifier for Windows* before update 8 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2019-14615: Insufficient control flow in certain data structures for some Intel(R) Processors with Intel(R) Processor Graphics may allow an unauthenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, insufficient control flow
CVE-2019-1462: A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft PowerPoint Remote Code Execution Vulnerability'.
Key phrases: remote code execution, microsoft powerpoint remote code execution
CVE-2019-14620: Insufficient control flow management for some Intel(R) Wireless Bluetooth(R) products may allow an unprivileged user to potentially enable denial of service via adjacent access.
Key phrases: potentially enable denial of service via adjacent access, insufficient control flow management
CVE-2019-14625: Improper access control in on-card storage for the Intel FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper access control
CVE-2019-14626: Improper access control in PCIe function for the Intel FPGA Programmable Acceleration Card N3000, all versions, may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2019-14629: Improper permissions in Intel(R) DAAL before version 2020 Gold may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper permissions
CVE-2019-1463: An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1400.
Key phrases: information disclosure, microsoft access information disclosure
CVE-2019-14630: Reliance on untrusted inputs in a security decision in some Intel(R) Thunderbolt(TM) controllers may allow unauthenticated user to potentially enable information disclosure via physical access.
Key phrases: potentially enable information disclosure via physical access, reliance on untrusted inputs
CVE-2019-1464: An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.
Key phrases: information disclosure, microsoft excel information disclosure
CVE-2019-1465: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1466, CVE-2019-1467.
Key phrases: information disclosure, windows gdi information disclosure
CVE-2019-14652: explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances.
Key phrases: XSS in certain circumstances, xss
CVE-2019-14653: pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.
Key phrases: XSS via an attribute of an ABBR or, xss
CVE-2019-14654: In Joomla! 3.9.7 and 3.9.8, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words, the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.
Key phrases: create custom fields to manipulate the filtering options, remote code execution
CVE-2019-14656: Yealink phones through 2019-08-04 do not properly check user roles in POST requests. Consequently, the default User account (with a password of user) can make admin requests via HTTP.
Key phrases: admin requests
CVE-2019-14657: Yealink phones through 2019-08-04 have an issue with OpenVPN file upload. They execute tar as root to extract files, but do not validate the extraction directory. Creating a tar file with ../../../../ allows replacement of almost any file on a phone. This leads to password replacement and arbitrary code execution as root.
Key phrases: password replacement and arbitrary code execution as root, file upload
CVE-2019-1466: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1467.
Key phrases: information disclosure, windows gdi information disclosure
CVE-2019-14662: Brandy 1.20.1 has a stack-based buffer overflow in fileio_openout in fileio.c via crafted BASIC source code.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2019-14663: Brandy 1.20.1 has a stack-based buffer overflow in fileio_openin in fileio.c via crafted BASIC source code.
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2019-14664: In Enigmail below 2.1, an attacker in possession of PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hidden using HTML/CSS or ASCII newline characters. This modified multipart email can be re-sent by the attacker to the intended receiver. If the receiver replies to this (benign looking) email, he unknowingly leaks the plaintext of the encrypted message part(s) back to the attacker. This attack variant bypasses protection mechanisms implemented after the "EFAIL" attacks.
Key phrases: attack variant
CVE-2019-14665: Brandy 1.20.1 has a heap-based buffer overflow in define_array in variables.c via crafted BASIC source code.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2019-14666: GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.
Key phrases: obtain other sensitive fields like API keys or password hashes, account takeover
CVE-2019-14667: Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.
Key phrases: xss
CVE-2019-14668: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.
Key phrases: stored xss
CVE-2019-14669: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.
Key phrases: stored xss
CVE-2019-1467: An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1465, CVE-2019-1466.
Key phrases: information disclosure, windows gdi information disclosure
CVE-2019-14670: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
Key phrases: stored xss
CVE-2019-14671: Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
Key phrases: local file enumeration
CVE-2019-14672: Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.
Key phrases: stored xss
CVE-2019-14678: SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multiple ways. Examples are Local File Reading, Out Of Band File Exfiltration, Server Side Request Forgery, and/or Potential Denial of Service attacks. This vulnerability also affects the XMLV2 LIBNAME engine when the AUTOMAP option is used.
Key phrases: xml external entity (xxe), local file reading, out of band file exfiltration, server side request forgery, potential denial of service
CVE-2019-14679: core/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.
Key phrases: wp-admin/admin.php?page=arplite_import_export CSRF, csrf
CVE-2019-1468: A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Code Execution Vulnerability'.
Key phrases: remote code execution
CVE-2019-14680: The admin-renamer-extended (aka Admin renamer extended) plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF.
Key phrases: wp-admin/plugins.php?page=admin-, csrf
CVE-2019-14681: The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=daf_settings&daf_remove=true CSRF.
Key phrases: wp-admin/options-general.php?page=, csrf
CVE-2019-14682: The acf-better-search (aka ACF: Better Search) plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbs_admin_page CSRF.
Key phrases: wp-admin/options-general.php?page=, csrf