Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-12214 State: PUBLISHED Published: 2017-09-21T05:00:00 Last Updated: 2024-08-05T18:28:16.638Z Vendors: n/a Products: Cisco Unified Customer Voice Portal Problem Types: CWE-264 Description: A vulnerability in the Operations, Administration, Maintenance, and Provisioning (OAMP) credential reset functionality for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation. An attacker could exploit this vulnerability by authenticating to the OAMP and sending a crafted HTTP request. A successful exploit could allow the attacker to gain administrator privileges. T
MP and sending a crafted HTTP request. A successful exploit could allow the attacker to gain administrator privileges. The attacker must successfully authenticate to the system to exploit this vulnerability. This vulnerability affects Cisco Unified Customer Voice Portal (CVP) running software release 10.5, 11.0, or 11.5. Cisco Bug IDs: CSCve92752. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039411 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-cvp - http://www.securityfocus.com/bid/100931
CVE ID: CVE-2017-12215 State: PUBLISHED Published: 2017-09-21T05:00:00 Last Updated: 2024-08-05T18:28:16.800Z Vendors: n/a Products: Cisco Email Security Appliance Problem Types: CWE-20 Description: A vulnerability in the email message filtering feature of Cisco AsyncOS Software for the Cisco Email Security Appliance could allow an unauthenticated, remote attacker to cause an affected device to run out of memory and stop scanning and forwarding email messages. When system memory is depleted, it can cause the filtering process to crash, resulting in a denial of service (DoS) condition on the device. This vulnerability affects software version 9.0 through the first fixed release of Cisco Async
condition on the device. This vulnerability affects software version 9.0 through the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. Cisco Bug IDs: CSCvd29354. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100920 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-esa - http://www.securitytracker.com/id/1039414
CVE ID: CVE-2017-12216 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.743Z Vendors: n/a Products: Cisco SocialMiner Problem Types: CWE-200 Description: A vulnerability in the web-based user interface of Cisco SocialMiner could allow an unauthenticated, remote attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and
system to import a crafted XML file with malicious entries, which could allow the attacker to read and write files and execute remote code within the application. Cisco Bug IDs: CSCvf47946. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039274 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-socmin - http://www.securityfocus.com/bid/100664
CVE ID: CVE-2017-12217 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.668Z Vendors: n/a Products: Cisco ASR 5500 System Architecture Evolution Gateway Problem Types: CWE-20 Description: A vulnerability in the General Packet Radio Service (GPRS) Tunneling Protocol ingress packet handler of Cisco ASR 5500 System Architecture Evolution (SAE) Gateways could allow an unauthenticated, remote attacker to cause a partial denial of service (DoS) condition on an affected device. The vulnerability is due to improper input validation of GPRS Tunneling Protocol packet headers. An attacker could exploit this vulnerability by sending a malformed GPRS Tunneling Protocol pa
Protocol packet headers. An attacker could exploit this vulnerability by sending a malformed GPRS Tunneling Protocol packet to an affected device. A successful exploit could allow the attacker to cause the GTPUMGR process on an affected device to restart unexpectedly, resulting in a partial DoS condition. If the GTPUMGR process restarts, there could be a brief impact on traffic passing through the device. Cisco Bug IDs: CSCve07119. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-asr - http://www.securityfocus.com/bid/100642 - http://www.securitytracker.com/id/1039276
CVE ID: CVE-2017-12218 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.751Z Vendors: n/a Products: Cisco Email Security Appliance Problem Types: CWE-20 Description: A vulnerability in the malware detection functionality within Advanced Malware Protection (AMP) of Cisco AsyncOS Software for Cisco Email Security Appliances (ESAs) could allow an unauthenticated, remote attacker to cause an email attachment containing malware to be delivered to the end user. The vulnerability is due to the failure of AMP to scan certain EML attachments that could contain malware. An attacker could exploit this vulnerability by sending an email with a crafted EML attachment throu
ld contain malware. An attacker could exploit this vulnerability by sending an email with a crafted EML attachment through the targeted device. A successful exploit could allow the attacker to bypass the configured ESA email message and content filtering and allow the malware to be delivered to the end user. Vulnerable Products: This vulnerability affects Cisco AsyncOS Software for Cisco ESA, both virtual and hardware appliances, that are configured with message or content filters to scan incoming email attachments on the ESA. Cisco Bug IDs: CSCuz81533. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco
otes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-esa - http://www.securityfocus.com/bid/100681 - http://www.securitytracker.com/id/1039288
CVE ID: CVE-2017-12219 State: PUBLISHED Published: 2017-09-21T05:00:00 Last Updated: 2024-08-05T18:28:16.791Z Vendors: n/a Products: Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones Problem Types: CWE-399 Description: A vulnerability in the handling of IP fragments for the Cisco Small Business SPA300, SPA500, and SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to the inability to handle many large IP fragments for reassembly in a short duration. An attacker could exploit this vulnerability by sending a crafted stream of IP fragments to
ssembly in a short duration. An attacker could exploit this vulnerability by sending a crafted stream of IP fragments to the targeted device. An exploit could allow the attacker to cause a DoS condition when the device unexpectedly reloads. Cisco Bug IDs: CSCve82586. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170920-spa - http://www.securityfocus.com/bid/100926 - http://www.securitytracker.com/id/1039413
CVE ID: CVE-2017-12220 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.729Z Vendors: n/a Products: Cisco Firepower Management Center Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to clic
erface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvc50771. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100639 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-firepower-1
CVE ID: CVE-2017-12221 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.741Z Vendors: n/a Products: Cisco Firepower Management Center Problem Types: CWE-79 Description: A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the affected software. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code in the context of the affected system. Cisco Bug IDs: CSCvc38983. Addit
uld allow the attacker to execute arbitrary code in the context of the affected system. Cisco Bug IDs: CSCvc38983. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-firepower-2 - http://www.securityfocus.com/bid/100640
CVE ID: CVE-2017-12222 State: PUBLISHED Published: 2017-09-28T07:00:00 Last Updated: 2024-08-05T18:28:16.603Z Vendors: n/a Products: Cisco IOS XE Problem Types: CWE-399 Description: A vulnerability in the wireless controller manager of Cisco IOS XE could allow an unauthenticated, adjacent attacker to cause a restart of the switch and result in a denial of service (DoS) condition. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by submitting a crafted association request. An exploit could allow the attacker to cause the switch to restart. This vulnerability affects Cisco Catalyst 3650 and 3850 switches running IOS XE Software versions 16
switch to restart. This vulnerability affects Cisco Catalyst 3650 and 3850 switches running IOS XE Software versions 16.1 through 16.3.3, and acting as wireless LAN controllers (WLC). Cisco Bug IDs: CSCvd45069. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ios-xe - http://www.securitytracker.com/id/1039458 - http://www.securityfocus.com/bid/101035
CVE ID: CVE-2017-12223 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.601Z Vendors: n/a Products: Cisco IR800 Integrated Services Router Problem Types: CWE-20 Description: A vulnerability in the ROM Monitor (ROMMON) code of Cisco IR800 Integrated Services Router Software could allow an unauthenticated, local attacker to boot an unsigned Hypervisor on an affected device and compromise the integrity of the system. The vulnerability is due to insufficient sanitization of user input. An attacker who can access an affected router via the console could exploit this vulnerability by entering ROMMON mode and modifying ROMMON variables. A successful exploit could al
e could exploit this vulnerability by entering ROMMON mode and modifying ROMMON variables. A successful exploit could allow the attacker to execute arbitrary code and install a malicious version of Hypervisor firmware on an affected device. Cisco Bug IDs: CSCvb44027. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-isr - http://www.securitytracker.com/id/1039275 - http://www.securityfocus.com/bid/100689
CVE ID: CVE-2017-12224 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.666Z Vendors: n/a Products: Cisco Meeting Server Problem Types: CWE-200 Description: A vulnerability in the ability for guest users to join meetings via a hyperlink with Cisco Meeting Server could allow an authenticated, remote attacker to enter a meeting with a hyperlink URL, even though access should be denied. The vulnerability is due to the incorrect implementation of the configuration setting Guest access via hyperlinks, which should allow the administrative user to prevent guest users from using hyperlinks to connect to meetings. An attacker could exploit this vulnerability by using
prevent guest users from using hyperlinks to connect to meetings. An attacker could exploit this vulnerability by using a crafted hyperlink to connect to a meeting. An exploit could allow the attacker to connect directly to the meeting with a hyperlink, even though access should be denied. The attacker would still require a valid hyperlink and encoded secret identifier to be connected. Cisco Bug IDs: CSCve20873. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cms - http://www.securitytracker.com/id/1039283 - http://www.securityfocus.com/bid/100657
CVE ID: CVE-2017-12225 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.588Z Vendors: n/a Products: Cisco Prime LAN Management Solution Problem Types: CWE-287 Description: A vulnerability in the web functionality of the Cisco Prime LAN Management Solution could allow an authenticated, remote attacker to hijack another user's administrative session, aka a Session Fixation Vulnerability. The vulnerability is due to the reuse of a preauthentication session token as part of the postauthentication session. An attacker could exploit this vulnerability by obtaining the presession token ID. An exploit could allow an attacker to hijack an existing user's session. Know
lity by obtaining the presession token ID. An exploit could allow an attacker to hijack an existing user's session. Known Affected Releases 4.2(5). Cisco Bug IDs: CSCvf58392. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039285 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-prime-lms - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf58392
CVE ID: CVE-2017-12226 State: PUBLISHED Published: 2017-09-28T07:00:00 Last Updated: 2024-08-05T18:28:16.643Z Vendors: n/a Products: Cisco IOS XE Problem Types: CWE-264 Description: A vulnerability in the web-based Wireless Controller GUI of Cisco IOS XE Software for Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, and Cisco New Generation Wireless Controllers (NGWC) 3850 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incomplete input validation of HTTP requests by the affected GUI, if the GUI connection state or protocol changes. An attacker could exploit this vu
of HTTP requests by the affected GUI, if the GUI connection state or protocol changes. An attacker could exploit this vulnerability by authenticating to the Wireless Controller GUI as a Lobby Administrator user of an affected device and subsequently changing the state or protocol for their connection to the GUI. A successful exploit could allow the attacker to elevate their privilege level to administrator and gain full control of the affected device. This vulnerability affects the following Cisco products if they are running Cisco IOS XE Software Release 3.7.0E, 3.7.1E, 3.7.2E, 3.7.3E, 3.7.4E, or 3.7.5E: Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wirele
7.2E, 3.7.3E, 3.7.4E, or 3.7.5E: Cisco 5760 Wireless LAN Controllers, Cisco Catalyst 4500E Supervisor Engine 8-E (Wireless) Switches, Cisco New Generation Wireless Controllers (NGWC) 3850. Cisco Bug IDs: CSCvd73746. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-ngwc - http://www.securitytracker.com/id/1039456 - http://www.securitytracker.com/id/1039457 - http://www.securityfocus.com/bid/101063
CVE ID: CVE-2017-12227 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.640Z Vendors: n/a Products: Cisco Emergency Responder Problem Types: CWE-89 Description: A vulnerability in the SQL database interface for Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a blind SQL injection attack. The vulnerability is due to a failure to validate user-supplied input used in SQL queries that bypass protection filters. An attacker could exploit this vulnerability by sending crafted URLs that include SQL statements. An exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data. Cisco Bug IDs: CSCvb58973. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039287 - http://www.securityfocus.com/bid/100653 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cer
CVE ID: CVE-2017-12228 State: PUBLISHED Published: 2017-09-28T07:00:00 Last Updated: 2024-08-05T18:28:16.694Z Vendors: n/a Products: Cisco IOS and IOS XE Problem Types: CWE-20 Description: A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in
y supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Cisco Bug IDs: CSCvc33171. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-pnp - http://www.securityfocus.com/bid/101065 - http://www.securitytracker.com/id/1039450
CVE ID: CVE-2017-12229 State: PUBLISHED Published: 2017-09-28T07:00:00 Last Updated: 2024-08-05T18:28:16.649Z Vendors: n/a Products: Cisco IOS XE Problem Types: CWE-287 Description: A vulnerability in the REST API of the web-based user interface (web UI) of Cisco IOS XE 3.1 through 16.5 could allow an unauthenticated, remote attacker to bypass authentication to the REST API of the web UI of the affected software. The vulnerability is due to insufficient input validation for the REST API of the affected software. An attacker could exploit this vulnerability by sending a malicious API request to an affected device. A successful exploit could allow the attacker to bypass authentication and gain
cious API request to an affected device. A successful exploit could allow the attacker to bypass authentication and gain access to the web UI of the affected software. This vulnerability affects Cisco devices that are running a vulnerable release of Cisco IOS XE Software, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration UI was introduced in the Denali 16.2 Release of Cisco IOS XE Software. This vulnerability does not affect the web-based administration UI in earlier releases of Cisco IOS XE Software. Cisco Bug IDs: CSCuz46036. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/Ci
036. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-restapi - http://www.securitytracker.com/id/1039447 - http://www.securityfocus.com/bid/101032
CVE ID: CVE-2017-12230 State: PUBLISHED Published: 2017-09-28T07:00:00 Last Updated: 2024-08-05T18:28:16.825Z Vendors: n/a Products: Cisco IOS XE Problem Types: CWE-264 Description: A vulnerability in the web-based user interface (web UI) of Cisco IOS XE 16.2 could allow an authenticated, remote attacker to elevate their privileges on an affected device. The vulnerability is due to incorrect default permission settings for new users who are created by using the web UI of the affected software. An attacker could exploit this vulnerability by using the web UI of the affected software to create a new user and then logging into the web UI as the newly created user. A successful exploit could all
software to create a new user and then logging into the web UI as the newly created user. A successful exploit could allow the attacker to elevate their privileges on the affected device. This vulnerability affects Cisco devices that are running a vulnerable release Cisco IOS XE Software, if the HTTP Server feature is enabled for the device. The newly redesigned, web-based administration UI was introduced in the Denali 16.2 Release of Cisco IOS XE Software. This vulnerability does not affect the web-based administration UI in earlier releases of Cisco IOS XE Software. Cisco Bug IDs: CSCuy83062. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/
Bug IDs: CSCuy83062. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-privesc - http://www.securityfocus.com/bid/101036 - http://www.securitytracker.com/id/1039446
CVE ID: CVE-2017-12231 State: PUBLISHED Published: 2017-09-28T07:00:00.000Z Last Updated: 2025-10-21T23:55:34.025Z Vendors: n/a Products: Cisco IOS Problem Types: CWE-399 Description: A vulnerability in the implementation of Network Address Translation (NAT) functionality in Cisco IOS 12.4 through 15.6 could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to the improper translation of H.323 messages that use the Registration, Admission, and Status (RAS) protocol and are sent to an affected device via IPv4 packets. An attacker could exploit this vulnerability by sending a crafted H.323 RAS packet through a
ed device via IPv4 packets. An attacker could exploit this vulnerability by sending a crafted H.323 RAS packet through an affected device. A successful exploit could allow the attacker to cause the affected device to crash and reload, resulting in a DoS condition. This vulnerability affects Cisco devices that are configured to use an application layer gateway with NAT (NAT ALG) for H.323 RAS messages. By default, a NAT ALG is enabled for H.323 RAS messages. Cisco Bug IDs: CSCvc57217. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1039449 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s
ttp://www.securitytracker.com/id/1039449 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170927-nat - http://www.securityfocus.com/bid/101039