Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2019-1918
A vulnerability in the implementation of Intermediate System&ndash;to&ndash;Intermediate System (IS&ndash;IS) routing protocol functionality in Cisco IOS XR Software could allow an unauthenticated attacker who is in the same IS-IS area to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of IS&ndash;IS link-state protocol data units (PDUs). An attacker could exploit this vulnerability by sending specific link-state PDUs to an affected system to be processed. A successful exploit could allow the attacker to cause incorrect calculations used in the weighted remote shared risk link groups (SRLG) or in the IGP Flexible Algorithm. It could also cause tracebacks to the logs or potentially cause the receiving device to crash the IS&ndash;IS process, resulting in a DoS condition.
Affected Products: Cisco IOS XR Software 
References: [{'name': '20190807 Cisco IOS XR Software Intermediate System–to–Intermediate System Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-isis-dos-1918'}]
CVE State: PUBLISHED
Explain CVE-2019-1919
A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to the VM console to log in to the device with a static account that has root privileges. The vulnerability is due to the presence of an account with static credentials in the underlying Linux operating system. An attacker could exploit this vulnerability by logging in to the command line of the affected VM with the static account. A successful exploit could allow the attacker to log in with root-level privileges. This vulnerability affects only Cisco FindIT Network Manager and Cisco FindIT Network Probe Release 1.1.4 if these products are using Cisco-supplied VM images. No other releases or deployment models are known to be vulnerable.
Affected Products: Cisco FindIT Network Manager 
References: [{'name': '20190717 Cisco FindIT Network Management Software Static Credentials Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred'}, {'name': '109305', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109305'}]
CVE State: PUBLISHED
Explain CVE-2019-1920
A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling condition for client authentication requests sent to a targeted interface configured for FT. An attacker could exploit this vulnerability by sending crafted authentication request traffic to the targeted interface, causing the device to restart unexpectedly.
Affected Products: Cisco Aironet Access Point Software 
References: [{'name': '20190717 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-aironet-dos'}, {'name': '109312', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109312'}]
CVE State: PUBLISHED
Explain CVE-2019-1921
A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper input validation of the email body. An attacker could exploit this vulnerability by naming a malicious attachment with a specific pattern. A successful exploit could allow the attacker to bypass configured content filters that would normally block the attachment.
Affected Products: Cisco Email Security Appliance (ESA) 
References: [{'name': '20190703 Cisco Email Security Appliance Content Filter Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-esa-bypass'}]
CVE State: PUBLISHED
Explain CVE-2019-1922
A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to insufficient validation of input Session Initiation Protocol (SIP) packets. An attacker could exploit this vulnerability by altering the SIP replies that are sent to the affected phone during the registration process. A successful exploit could allow the attacker to cause the phone to reboot and not complete the registration process.
Affected Products: Cisco IP Phone 8800 Series Software 
References: [{'name': '20190703 Cisco IP Phone 7800 and 8800 Series Session Initiation Protocol Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ip-phone-sip-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1923
A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior.
Affected Products: Cisco SPA525G2 5-line IP Phone 
References: [{'name': '20190717 Cisco Small Business SPA500 Series IP Phones Local Command Execution Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-spa500-command'}, {'name': '109294', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109294'}]
CVE State: PUBLISHED
Explain CVE-2019-1924
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Affected Products: Cisco WebEx WRF Player 
References: [{'name': '20190807 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player'}]
CVE State: PUBLISHED
Explain CVE-2019-1925
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Affected Products: Cisco WebEx WRF Player 
References: [{'name': '20190807 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player'}]
CVE State: PUBLISHED
Explain CVE-2019-1926
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Affected Products: Cisco WebEx WRF Player 
References: [{'name': '20190807 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player'}]
CVE State: PUBLISHED
Explain CVE-2019-1927
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Affected Products: Cisco WebEx WRF Player 
References: [{'name': '20190807 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player'}]
CVE State: PUBLISHED
Explain CVE-2019-1928
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Affected Products: Cisco WebEx WRF Player 
References: [{'name': '20190807 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player'}]
CVE State: PUBLISHED
Explain CVE-2019-1929
Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.
Affected Products: Cisco WebEx WRF Player 
References: [{'name': '20190807 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player'}]
CVE State: PUBLISHED
Explain CVE-2019-1930
Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected Products: Cisco Firepower Management Center 
References: [{'name': '20190703 Cisco Firepower Management Center RSS Cross-Site Scripting Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-fmc-xss'}]
CVE State: PUBLISHED
Explain CVE-2019-1931
Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected Products: Cisco Firepower Management Center 
References: [{'name': '20190703 Cisco Firepower Management Center RSS Cross-Site Scripting Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-fmc-xss'}]
CVE State: PUBLISHED
Explain CVE-2019-1932
A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows filesystem. A successful exploit could allow the attacker to execute the code with the privileges of the AMP service.
Affected Products: Cisco AMP for Endpoints 
References: [{'name': '20190703 Cisco Advanced Malware Protection for Endpoints Windows Command Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-amp-commandinj'}]
CVE State: PUBLISHED
Explain CVE-2019-1933
A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper input validation of certain email fields. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass configured message filters and inject arbitrary scripting code inside the email body. The malicious code is not executed by default unless the recipient's email client is configured to execute scripts contained in emails.
Affected Products: Cisco Email Security Appliance (ESA) 
References: [{'name': '20190703 Cisco Email Security Appliance Content Filter Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-esa-filterpass'}]
CVE State: PUBLISHED
Explain CVE-2019-1934
A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to elevate privileges and execute administrative functions on an affected device. The vulnerability is due to insufficient authorization validation. An attacker could exploit this vulnerability by logging in to an affected device as a low-privileged user and then sending specific HTTPS requests to execute administrative functions using the information retrieved during initial login.
Affected Products: Cisco Adaptive Security Appliance (ASA) Software 
References: [{'name': '20190807 Cisco Adaptive Security Appliance Software Web-Based Management Interface Privilege Escalation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-privescala'}]
CVE State: PUBLISHED
Explain CVE-2019-1935
A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database.
Affected Products: Cisco Unified Computing System Director 
References: [{'name': '20190821 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data SCP User Default Credentials Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-usercred'}, {'name': '20190828 Multiple vulns in Cisco UCS Director: from unauth remote access to code execution as root', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://seclists.org/bugtraq/2019/Aug/49'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html'}, {'name': '20190830 Multiple vulns in Cisco UCS Director: from unauth remote access to code execution as root', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2019/Aug/36'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/154305/Cisco-UCS-Director-Default-scpuser-Password.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1936
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux shell as the root user. Exploitation of this vulnerability requires privileged access to an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrator privileges and then sending a malicious request to a certain part of the interface.
Affected Products: Cisco Unified Computing System Director 
References: [{'name': '20190821 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Command Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-cmdinj'}, {'name': '20190828 Multiple vulns in Cisco UCS Director: from unauth remote access to code execution as root', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://seclists.org/bugtraq/2019/Aug/49'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html'}, {'name': '20190830 Multiple vulns in Cisco UCS Director: from unauth remote access to code execution as root', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2019/Aug/36'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1937
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to acquire a valid session token with administrator privileges, bypassing user authentication. The vulnerability is due to insufficient request header validation during the authentication process. An attacker could exploit this vulnerability by sending a series of malicious requests to an affected device. An exploit could allow the attacker to use the acquired session token to gain full administrator access to the affected device.
Affected Products: Cisco Unified Computing System Director 
References: [{'name': '20190821 Cisco Integrated Management Controller Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data Authentication Bypass Vulnerability', 'tags': ['vendor-advisory'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-ucs-authby'}, {'name': '20190828 Multiple vulns in Cisco UCS Director: from unauth remote access to code execution as root', 'tags': ['mailing-list'], 'url': 'https://seclists.org/bugtraq/2019/Aug/49'}, {'url': 'http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html'}, {'name': '20190830 Multiple vulns in Cisco UCS Director: from unauth remote access to code execution as root', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2019/Aug/36'}, {'url': 'http://packetstormsecurity.com/files/154308/Cisco-UCS-Director-Unauthenticated-Remote-Code-Execution.html'}, {'url': 'http://packetstormsecurity.com/files/173531/Cisco-UCS-IMC-Supervisor-2.2.0.0-Authentication-Bypass.html'}]
CVE State: PUBLISHED
Explain CVE-2019-1938
A vulnerability in the web-based management interface of Cisco UCS Director and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The vulnerability is due to improper authentication request handling. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an unprivileged attacker to access and execute arbitrary actions through certain APIs.
Affected Products: Cisco Unified Computing System Director 
References: [{'name': '20190821 Cisco UCS Director and Cisco UCS Director Express for Big Data API Authentication Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-ucsd-authbypass'}]
CVE State: PUBLISHED
Explain CVE-2019-1939
A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. This vulnerability is due to improper restrictions on software logging features used by the application on Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to visit a website designed to submit malicious input to the affected application. A successful exploit could allow the attacker to cause the application to modify files and execute arbitrary commands on the system with the privileges of the targeted user.
Affected Products: Cisco Webex Teams 
References: [{'name': '20190904 Cisco Webex Teams Logging Feature Command Execution Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-webex-teams'}]
CVE State: PUBLISHED
Explain CVE-2019-1940
A vulnerability in the Web Services Management Agent (WSMA) feature of Cisco Industrial Network Director (IND) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invalid X.509 certificate. The vulnerability is due to insufficient X.509 certificate validation when establishing a WSMA connection. An attacker could exploit this vulnerability by supplying a crafted X.509 certificate during the WSMA connection setup phase. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on WSMA connections to the affected software. At the time of publication, this vulnerability affected Cisco IND Software releases prior to 1.7.
Affected Products: Cisco Industrial Network Director 
References: [{'name': '20190717 Cisco Industrial Network Director Web Services Management Agent Unauthorized Information Disclosure Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-wsma-info'}, {'name': '109296', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109296'}]
CVE State: PUBLISHED
Explain CVE-2019-1941
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. At the time of publication, this vulnerability affected Cisco ISE running software releases prior to 2.4.0 Patch 9 and 2.6.0.
Affected Products: Cisco Identity Services Engine Software 
References: [{'name': '20190717 Cisco Identity Services Engine Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-ise-xss'}, {'name': '109297', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109297'}]
CVE State: PUBLISHED
Explain CVE-2019-1942
A vulnerability in the sponsor portal web interface for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data. At the time of publication, this vulnerability affected Cisco ISE running software releases 2.6.0 and prior.
Affected Products: Cisco Identity Services Engine Software 
References: [{'name': '20190717 Cisco Identity Services Engine Blind SQL Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-ise-sql-inject'}, {'name': '109283', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109283'}]
CVE State: PUBLISHED
Explain CVE-2019-1943
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
Affected Products: Cisco Small Business 300 Series Managed Switches 
References: [{'name': '20190717 Cisco Small Business Series Switches Open Redirect Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-sbss-redirect'}, {'name': '109288', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/109288'}]
CVE State: PUBLISHED
Explain CVE-2019-1944
Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being established. For more information about these vulnerabilities, see the Details section of this security advisory.
Affected Products: Cisco Adaptive Security Appliance (ASA) Software 
References: [{'name': '20190807 Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-multi'}]
CVE State: PUBLISHED
Explain CVE-2019-1945
Multiple vulnerabilities in the smart tunnel functionality of Cisco Adaptive Security Appliance (ASA) could allow an authenticated, local attacker to elevate privileges to the root user or load a malicious library file while the tunnel is being established. For more information about these vulnerabilities, see the Details section of this security advisory.
Affected Products: Cisco Adaptive Security Appliance (ASA) Software 
References: [{'name': '20190807 Cisco Adaptive Security Appliance Smart Tunnel Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-multi'}]
CVE State: PUBLISHED
Explain CVE-2019-1946
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management interface. The vulnerability is due to an incorrect implementation of authentication in the web-based management interface. An attacker could exploit this vulnerability by sending a crafted authentication request to the web-based management interface on an affected system. A successful exploit could allow the attacker to view limited configuration details and potentially upload a virtual machine image.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Web-Based Management Interface Authentication Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfvis-authbypass'}]
CVE State: PUBLISHED
Explain CVE-2019-1947
A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause the CPU utilization to increase to 100 percent, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of email messages that contain large attachments. An attacker could exploit this vulnerability by sending a malicious email message through the targeted device. A successful exploit could allow the attacker to cause a permanent DoS condition due to high CPU utilization. This vulnerability may require manual intervention to recover the ESA.
Affected Products: Cisco Email Security Appliance (ESA) 
References: [{'name': '20200219 Cisco Email Security Appliance Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200219-esa-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1948
A vulnerability in Cisco Webex Meetings Mobile (iOS) could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer (SSL) certificate. The vulnerability is due to insufficient SSL certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted SSL certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.
Affected Products: Cisco WebEx Meetings for iOS 
References: [{'name': '20190821 Cisco Webex Meetings Mobile (iOS) SSL Certificate Validation Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-webex-ssl-cert'}]
CVE State: PUBLISHED
Explain CVE-2019-1949
A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected Products: Cisco Firepower Management Center 
References: [{'name': '20190807 Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-fmc-xss'}]
CVE State: PUBLISHED
Explain CVE-2019-1950
A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerability is due to the existence of default credentials within the default configuration of an affected device. An attacker who has access to an affected device could log in with elevated privileges. A successful exploit could allow the attacker to take complete control of the device. This vulnerability affects Cisco devices that are running Cisco IOS XE SD-WAN Software releases 16.11 and earlier.
Affected Products: Cisco IOS XE SD-WAN Software
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-cred-EVGSF259'}]
CVE State: PUBLISHED
Explain CVE-2019-1951
A vulnerability in the packet filtering features of Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass L3 and L4 traffic filters. The vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this vulnerability by crafting a malicious TCP packet with specific characteristics and sending it to a target device. A successful exploit could allow the attacker to bypass the L3 and L4 traffic filters and inject an arbitrary packet in the network.
Affected Products: Cisco SD-WAN Solution 
References: [{'name': '20190807 Cisco SD-WAN Solution Packet Filtering Bypass Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-sd-wan-bypass'}]
CVE State: PUBLISHED
Explain CVE-2019-1952
A vulnerability in the CLI of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to overwrite or read arbitrary files. The attacker would need valid administrator privilege-level credentials. This vulnerability is due to improper input validation of CLI command arguments. An attacker could exploit this vulnerability by using directory traversal techniques when executing a vulnerable command. A successful exploit could allow the attacker to overwrite or read arbitrary files on an affected device.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-cli-path'}]
CVE State: PUBLISHED
Explain CVE-2019-1953
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-pwrecov'}]
CVE State: PUBLISHED
Explain CVE-2019-1954
A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerability by crafting an HTTP request that could cause the web application to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious website.
Affected Products: Cisco WebEx Meetings Server 
References: [{'name': '20190807 Cisco Webex Meetings Server Open Redirection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-wms-oredirect'}]
CVE State: PUBLISHED
Explain CVE-2019-1955
A vulnerability in the Sender Policy Framework (SPF) functionality of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured user filters on the device. The vulnerability is due to incomplete input and validation checking mechanisms for certain SPF messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. A successful exploit could allow the attacker to bypass the header filters that are configured for the affected device, which could allow malicious content to pass through the device.
Affected Products: Cisco Email Security Appliance (ESA) 
References: [{'name': '20190807 Cisco Email Security Appliance Header Injection Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-esm-inject'}]
CVE State: PUBLISHED
Explain CVE-2019-1956
A vulnerability in the web-based interface of the Cisco SPA112 2-Port Phone Adapter could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against another user of the device. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected device. An attacker could exploit this vulnerability by inserting malicious code in one of the configuration fields. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected Products: Cisco SPA112 2-Port Phone Adapter 
References: [{'name': '20190807 Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-spa112-xss'}]
CVE State: PUBLISHED
Explain CVE-2019-1957
A vulnerability in the web interface of Cisco IoT Field Network Director could allow an unauthenticated, remote attacker to trigger high CPU usage, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of Transport Layer Security (TLS) renegotiation requests. An attacker could exploit this vulnerability by sending renegotiation requests at a high rate. A successful exploit could increase the resource usage on the system, eventually leading to a DoS condition.
Affected Products: Cisco IoT Field Network Director (IoT-FND) 
References: [{'name': '20190807 Cisco IoT Field Network Director TLS Renegotiation Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-fnd-dos'}]
CVE State: PUBLISHED
Explain CVE-2019-1958
A vulnerability in the web-based management interface of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
Affected Products: Cisco HyperFlex HX-Series 
References: [{'name': '20190807 Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-hypflex-csrf'}]
CVE State: PUBLISHED
Explain CVE-2019-1959
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-read'}]
CVE State: PUBLISHED
Explain CVE-2019-1960
Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, local attacker to read arbitrary files on the underlying operating system (OS) of an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-read'}]
CVE State: PUBLISHED
Explain CVE-2019-1961
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS.
Affected Products: Cisco Enterprise NFV Infrastructure Software 
References: [{'name': '20190807 Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-nfv-fileread'}]
CVE State: PUBLISHED
Explain CVE-2019-1962
A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause process crashes, which can result in a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient validation of TCP packets when processed by the Cisco Fabric Services over IP (CFSoIP) feature. An attacker could exploit this vulnerability by sending a malicious Cisco Fabric Services TCP packet to an affected device. A successful exploit could allow the attacker to cause process crashes, resulting in a device reload and a DoS condition. Note: There are three distribution methods that can be configured for Cisco Fabric Services. This vulnerability affects only distribution method CFSoIP, which is disabled by default. See the Details section for more information.
Affected Products: Cisco Unified Computing System (Managed) 
References: [{'name': '20190828 Cisco NX-OS Software Cisco Fabric Services over IP Denial of Service Vulnerability', 'tags': ['vendor-advisory', 'x_refsource_CISCO'], 'url': 'https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190828-nxos-fsip-dos'}]
CVE State: PUBLISHED