CIRCL/vulnerability-attack-techniques huggingface dataset:
CVE-2020-0758: 
An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle pipeline job tokens, aka 'Azure DevOps Server and Team Foundation Services Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0815.

Affected products: Microsoft Team Foundation Server 2018, Microsoft Team Foundation Server, Microsoft Azure DevOps Server, Microsoft Azure DevOps Server 2019, Microsoft Azure DevOps Server 2019 Update 1.1
CWE: Elevation of Privilege
ATT&CK exploitation technique(s): T1098
ATT&CK primary impact: T1068
ATT&CK techniques (all): T1068, T1098
CVE-2019-1704: Cisco Firepower Threat Defense Software SMB Protocol Preprocessor Detection Engine Denial of Service Vulnerabilities
Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, adjacent or remote attacker to cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.

Affected products: Cisco Cisco Firepower Threat Defense Software
CWE: CWE-400
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1499
ATT&CK techniques (all): T1190, T1499
CVE-2015-0072: 
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."

ATT&CK techniques (all): T1190
CVE-2020-4068: Heap-based Buffer Overflow in APNSwift
In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is likely to result in a heap buffer overflow. This has been fixed in 1.0.1.

Affected products: kylebrowning APNSwift
CWE: CWE-122: Heap-based Buffer Overflow
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
ATT&CK exploitation technique(s): T1091, T1133, T1189, T1190, T1204.002, T1566
ATT&CK primary impact: T1499.004, T1574
ATT&CK techniques (all): T1091, T1133, T1189, T1190, T1204.002, T1499.004, T1566, T1574
CVE-2023-27524: Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.
Add a strong SECRET_KEY to your `superset_config.py` file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

Affected products: Apache Software Foundation Apache Superset
CWE: CWE-1188 Insecure Default Initialization of Resource
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1078
ATT&CK techniques (all): T1078, T1190
CVE-2025-21334: Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability
Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Affected products: Microsoft Windows 10 Version 21H2, Microsoft Windows 10 Version 22H2, Microsoft Windows 11 version 22H2, Microsoft Windows 11 version 22H3, Microsoft Windows 11 Version 23H2, Microsoft Windows 11 Version 24H2, Microsoft Windows Server 2022, 23H2 Edition (Server Core installation), Microsoft Windows Server 2025, Microsoft Windows Server 2025 (Server Core installation)
CWE: CWE-416: Use After Free
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATT&CK exploitation technique(s): T1068
ATT&CK primary impact: T1003
ATT&CK techniques (all): T1003, T1068
CVE-2024-5274: 
Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Affected products: Google Chrome, google chrome
CWE: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1189
ATT&CK primary impact: T1203
ATT&CK techniques (all): T1189, T1203
CVE-2018-11059: 
RSA Archer, versions prior to 6.4.0.1, contain a stored cross-site scripting vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application.

Affected products: Dell EMC RSA Archer
CWE: Stored Cross-Site Scripting Vulnerability
CVSS: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
ATT&CK exploitation technique(s): T1189
ATT&CK primary impact: T1059.007
ATT&CK secondary impact: T1185
ATT&CK techniques (all): T1059.007, T1185, T1189
CVE-2019-2729: 
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected products: Oracle Corporation WebLogic Server
CWE: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.
CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK techniques (all): T1059, T1190
CVE-2014-1809: 
The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, as exploited in the wild in May 2014, aka "MSCOMCTL ASLR Vulnerability."

ATT&CK techniques (all): T1190
CVE-2021-22986: 
On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

Affected products: BIG-IP; BIG-IQ
CWE: Remote Command Execution, CWE-918 Server-Side Request Forgery (SSRF)
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1133, T1190
ATT&CK primary impact: T1059, T1090
ATT&CK secondary impact: T1485
ATT&CK techniques (all): T1059, T1090, T1133, T1190, T1485
CVE-2024-57968: 
Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.

Affected products: Advantive VeraCore
CWE: CWE-434 Unrestricted Upload of File with Dangerous Type
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
ATT&CK exploitation technique(s): T1078
ATT&CK primary impact: T1059
ATT&CK techniques (all): T1059, T1078
CVE-2018-11088: 
Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may allow escalation of privileges. A space developer with access to the system org may be able to access an artifact which contains the CF admin credential, allowing them to escalate to an admin role.

Affected products: Pivotal Application Service
CWE: Credential leak
ATT&CK primary impact: T1552
ATT&CK secondary impact: T1068
ATT&CK techniques (all): T1068, T1552
CVE-2021-34523: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability

Affected products: Microsoft Microsoft Exchange Server 2013 Cumulative Update 23, Microsoft Microsoft Exchange Server 2019 Cumulative Update 9, Microsoft Microsoft Exchange Server 2016 Cumulative Update 20, Microsoft Microsoft Exchange Server 2016 Cumulative Update 19, Microsoft Microsoft Exchange Server 2019 Cumulative Update 8
CWE: Elevation of Privilege, CWE-noinfo Not enough information
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
ATT&CK exploitation technique(s): T1190
ATT&CK techniques (all): T1190
CVE-2020-11021: HTTP request which redirect to another hostname do not strip authorization header in Actions Http-Client
Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redirect scenarios. The conditions in which this happens are if consumers of the http-client: 1. make an http request with an authorization header 2. that request leads to a redirect (302) and 3. the redirect url redirects to another domain or hostname Then the authorization header will get passed to the other domain. The problem is fixed in version 1.0.8.

Affected products: actions http-client
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
ATT&CK exploitation technique(s): T1190
ATT&CK primary impact: T1005
ATT&CK techniques (all): T1005, T1190
CVE-2010-2862: 
Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table.

ATT&CK techniques (all): T1203, T1204.002