Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-12286 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:55.355Z Vendors: n/a Products: Cisco Jabber Problem Types: CWE-20 Description: A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected software, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input and validation checks in the affected software. An attacker could exploit this vulnerability by authenticating locally to an affected system and then issuing specific commands to the affected software. A successful exploit could allow the attacker
ected system and then issuing specific commands to the affected software. A successful exploit could allow the attacker to view all profile information for a user instead of only certain Jabber parameters that should be visible. This vulnerability affects all releases of Cisco Jabber prior to Release 1.9.31. Cisco Bug IDs: CSCve52418. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039625 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-jab1 - http://www.securityfocus.com/bid/101515
CVE ID: CVE-2017-12287 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:54.549Z Vendors: n/a Products: Cisco Expressway Series and Cisco TelePresence Video Communication Server Problem Types: CWE-399 Description: A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communication Server (VCS) Software could allow an authenticated, remote attacker to cause the CDB process on an affected system to restart unexpectedly, resulting in a temporary denial of service (DoS) condition. The vulnerability is due to incomplete input validation of URL requests by the REST API of the affected softwar
ndition. The vulnerability is due to incomplete input validation of URL requests by the REST API of the affected software. An attacker could exploit this vulnerability by sending a crafted URL to the REST API of the affected software on an affected system. A successful exploit could allow the attacker to cause the CDB process on the affected system to restart unexpectedly, resulting in a temporary DoS condition. Cisco Bug IDs: CSCve77571. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101525 - http://www.securitytracker.com/id/1039626 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-expressway-tp-vcs
CVE ID: CVE-2017-12288 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:55.947Z Vendors: n/a Products: Cisco Unified Contact Center Express Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Unified Contact Center Express could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit
could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf09173. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039620 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ucce - http://www.securityfocus.com/bid/101514
CVE ID: CVE-2017-12289 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:56.392Z Vendors: n/a Products: Cisco IOS XE Problem Types: CWE-200 Description: A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local attacker to display sensitive IPsec information in the system log file. The vulnerability is due to incorrect implementation of IPsec conditional, verbose debug logging that causes sensitive information to be written to the log file. This information should be restricted. An attacker who has valid administrative credentials could exploit this vulnerability by authenticating to t
restricted. An attacker who has valid administrative credentials could exploit this vulnerability by authenticating to the device and enabling conditional, verbose debug logging for IPsec and viewing the log file. An exploit could allow the attacker to access sensitive information related to the IPsec configuration. Cisco Bug IDs: CSCvf12081. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039628 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-cisco-ios-xe1 - http://www.securityfocus.com/bid/101509
CVE ID: CVE-2017-12290 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:54.550Z Vendors: n/a Products: Cisco Registered Envelope Service Problem Types: CWE-79 Description: Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit these vulnerabilities by persuading a user to click a ma
nt interface of the affected service. An attacker could exploit these vulnerabilities by persuading a user to click a malicious link or by sending an HTTP request that could cause the affected service to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web interface of the affected system or allow the attacker to access sensitive browser-based information on the affected system. These types of exploits could also be used in phishing attacks that send users to malicious websites without their knowledge. Cisco Bug IDs: CSCve77195, CSCve90978, CSCvf42310, CSCvf42703, CSCvf42723, CSCvf46169, CS
sites without their knowledge. Cisco Bug IDs: CSCve77195, CSCve90978, CSCvf42310, CSCvf42703, CSCvf42723, CSCvf46169, CSCvf49999. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-res - http://www.securityfocus.com/bid/101863
CVE ID: CVE-2017-12291 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:55.849Z Vendors: n/a Products: Cisco Registered Envelope Service Problem Types: CWE-79 Description: Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit these vulnerabilities by persuading a user to click a ma
CVE ID: CVE-2017-12292 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:55.651Z Vendors: n/a Products: Cisco Registered Envelope Service Problem Types: CWE-79 Description: Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack or redirect a user of the affected service to an undesired web page. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit these vulnerabilities by persuading a user to click a ma
CVE ID: CVE-2017-12293 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:55.669Z Vendors: n/a Products: Cisco WebEx Meetings Server Problem Types: CWE-119 Description: A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient limitations on the number of connections that can be made to the affected software. An attacker could exploit this vulnerability by opening multiple connections to the server and exhausting server resources. A successful exploit could cause the server to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf41006. A
urces. A successful exploit could cause the server to reload, resulting in a DoS condition. Cisco Bug IDs: CSCvf41006. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-wms - http://www.securityfocus.com/bid/101492 - http://www.securitytracker.com/id/1039618
CVE ID: CVE-2017-12294 State: PUBLISHED Published: 2017-11-02T16:00:00 Last Updated: 2024-08-05T18:36:56.102Z Vendors: n/a Products: Cisco WebEx Meetings Server Problem Types: CWE-79 Description: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exp
ollow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf85562. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-webex1 - http://www.securityfocus.com/bid/101654 - http://www.securitytracker.com/id/1039721
CVE ID: CVE-2017-12295 State: PUBLISHED Published: 2017-11-02T16:00:00 Last Updated: 2024-08-05T18:36:56.203Z Vendors: n/a Products: Cisco WebEx Meetings Server Problem Types: CWE-200 Description: A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the HTTP header reply from the Cisco WebEx Meetings Server to the client, which could include internal network information that should be restricted. An attacker could exploit the vulnerability by attempting to use the HT
l network information that should be restricted. An attacker could exploit the vulnerability by attempting to use the HTTP protocol and looking at the data in the HTTP responses from the Cisco WebEx Meetings Server. An exploit could allow the attacker to discover sensitive data about the application. Cisco Bug IDs: CSCve65818. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039722 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-webex2 - http://www.securityfocus.com/bid/101651
CVE ID: CVE-2017-12296 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:56.099Z Vendors: n/a Products: Cisco WebEx Meetings Server Problem Types: CWE-79 Description: A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful e
follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf51241, CSCvf51261. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-wms1 - http://www.securitytracker.com/id/1039617 - http://www.securityfocus.com/bid/101489
CVE ID: CVE-2017-12297 State: PUBLISHED Published: 2017-11-30T09:00:00 Last Updated: 2024-08-05T18:36:55.837Z Vendors: n/a Products: Cisco WebEx Meeting Center Problem Types: CWE-20 Description: A vulnerability in Cisco WebEx Meeting Center could allow an authenticated, remote attacker to initiate connections to arbitrary hosts, aka a "URL Redirection Vulnerability." The vulnerability is due to insufficient access control for HTTP traffic directed to the Cisco WebEx Meeting Center. An attacker could exploit this vulnerability by sending a malicious URL to the Cisco WebEx Meeting Center. An exploit could allow the attacker to connect to arbitrary hosts. Cisco Bug IDs: CSCvf63843. Additional A
eting Center. An exploit could allow the attacker to connect to arbitrary hosts. Cisco Bug IDs: CSCvf63843. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-wmc - http://www.securityfocus.com/bid/101985 - http://www.securitytracker.com/id/1039919
CVE ID: CVE-2017-12298 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:56.182Z Vendors: n/a Products: Cisco WebEx Meeting Center Problem Types: CWE-79 Description: A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful expl
llow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf78615, CSCvf78628. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-wmc1 - http://www.securitytracker.com/id/1039619 - http://www.securityfocus.com/bid/101491
CVE ID: CVE-2017-12299 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:55.881Z Vendors: n/a Products: Cisco ASA Next-Generation Firewall Services Problem Types: CWE-20 Description: A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall Services that could allow an unauthenticated, remote attacker to send traffic to the local IP address of the device, bypassing any filters that are configured to deny local IP management traffic. The vulnerability is due to an implementation error that exists in the process of creating default IP blocks when the device is initialized, and the way in
mentation error that exists in the process of creating default IP blocks when the device is initialized, and the way in which those IP blocks interact with user-configured filters for local IP management traffic (for example, SSH to the device). An attacker could exploit this vulnerability by sending traffic to the local IP address of the targeted device. A successful exploit could allow the attacker to connect to the local IP address of the device even when there are filters configured to deny the traffic. Cisco Bug IDs: CSCvd97962. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-firepow
Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-firepower1 - http://www.securityfocus.com/bid/101915
CVE ID: CVE-2017-12300 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:55.890Z Vendors: n/a Products: Cisco Firepower System Software Problem Types: CWE-20 Description: A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the Server Message Block Version 2 (SMB2) protocol. The vulnerability is due to the incorrect detection of an SMB2 file when the detection is based on the length of the file. An attacker could exploit this vulnerability by sending a crafted SMB2 transfer request through the targeted device. A successful exploit could
t this vulnerability by sending a crafted SMB2 transfer request through the targeted device. A successful exploit could allow the attacker to bypass filters that are configured to block SMB2 traffic. Cisco Bug IDs: CSCve58398. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101862 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-firepower2
CVE ID: CVE-2017-12301 State: PUBLISHED Published: 2017-10-19T08:00:00 Last Updated: 2024-08-05T18:36:55.801Z Vendors: n/a Products: Cisco NX-OS Software Problem Types: CWE-20 Description: A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and gain unauthorized access to the underlying operating system of the device. The vulnerability exists due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions within the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary com
affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user. To exploit this vulnerability, an attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit. This vulnerability affects the following Cisco products if they are running Cisco NX-OS Software: Multilayer Director Switches, Nexus 2000 Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5000 Series Switches, Nexus 55
Series Fabric Extenders, Nexus 3000 Series Switches, Nexus 3500 Platform Switches, Nexus 5000 Series Switches, Nexus 5500 Platform Switches, Nexus 5600 Platform Switches, Nexus 6000 Series Switches, Nexus 7000 Series Switches, Nexus 7700 Series Switches, Nexus 9000 Series Switches - Standalone, NX-OS mode, Nexus 9500 R-Series Line Cards and Fabric Modules. Cisco Bug IDs: CSCvb86832, CSCvd86474, CSCvd86479, CSCvd86484, CSCvd86490, CSCve97102, CSCvf12757, CSCvf12804, CSCvf12815, CSCvf15198. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039622 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-ppe
CVE ID: CVE-2017-12302 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:55.827Z Vendors: n/a Products: Cisco Unified Communications Manager Problem Types: CWE-89 Description: A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact the confidentiality of the system by executing arbitrary SQL queries, aka SQL Injection. The vulnerability is due to a lack of input validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected system. An exploit could allow the attacker to det
ng crafted URLs that contain malicious SQL statements to the affected system. An exploit could allow the attacker to determine the presence of certain values in the database. Cisco Bug IDs: CSCvf36682. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-ucm - http://www.securitytracker.com/id/1039826 - http://www.securityfocus.com/bid/101853
CVE ID: CVE-2017-12303 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:55.948Z Vendors: n/a Products: Cisco Web Security Appliance Problem Types: CWE-358 Description: A vulnerability in the Advanced Malware Protection (AMP) file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to bypass a configured AMP file filtering rule. The file types affected are zipped or archived file types. The vulnerability is due to incorrect and different file hash values when AMP scans the file. An attacker could exploit this vulnerability by sending a crafted email file attachment through the targeted
s the file. An attacker could exploit this vulnerability by sending a crafted email file attachment through the targeted device. An exploit could allow the attacker to bypass a configured AMP file filter. Cisco Bug IDs: CSCvf52943. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039828 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-wsa - http://www.securityfocus.com/bid/101932
CVE ID: CVE-2017-12304 State: PUBLISHED Published: 2017-11-16T07:00:00 Last Updated: 2024-08-05T18:36:54.508Z Vendors: n/a Products: Cisco IOS and IOS XE Problem Types: CWE-79 Description: A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful
n attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the web-based management interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf60862. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101856 - http://www.securitytracker.com/id/1039825 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171115-ios