Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tion of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to arbitrarily overwrite files resulting in a denial-of-service condition. Was ZDI-CAN-4222. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-005
CVE ID: CVE-2018-1163 State: PUBLISHED Published: 2018-02-08T18:00:00 Last Updated: 2024-08-05T03:51:48.993Z Vendors: Quest Products: Quest NetVault Backup Problem Types: CWE-287 Description: This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value, it is possible to bypass authentication to critical functions. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4752. Additional Analyst Notes: - CVE Program Container: Re
execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4752. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-006
CVE ID: CVE-2018-1164 State: PUBLISHED Published: 2018-02-21T14:00:00 Last Updated: 2024-08-05T03:51:48.916Z Vendors: ZyXEL Products: ZyXEL P-870H-51 DSL Router Problem Types: CWE-306 Description: This vulnerability allows remote attackers to cause a denial-of-service condition on vulnerable installations of ZyXEL P-870H-51 DSL Router 1.00(AWG.3)D5. Authentication is not required to exploit this vulnerability. The specific flaw exists within numerous exposed CGI endpoints. The vulnerability is caused by improper access controls that allow access to critical functions without authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-C
t authentication. An attacker can use this vulnerability to reboot affected devices, along with other actions. Was ZDI-CAN-4540. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-135
CVE ID: CVE-2018-1165 State: PUBLISHED Published: 2018-02-21T14:00:00 Last Updated: 2024-08-05T03:51:48.985Z Vendors: Joyent Products: Joyent SmartOS Problem Types: CWE-122 Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMB_IOC_SVCENUM IOCTL. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage thi
the length of user-supplied data prior to copying it to a fixed-length, heap-based buffer. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4983. Additional Analyst Notes: - CVE Program Container: References: - https://help.joyent.com/hc/en-us/articles/360000124928 - https://zerodayinitiative.com/advisories/ZDI-18-158 - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-1166 State: PUBLISHED Published: 2018-02-21T14:00:00 Last Updated: 2024-08-05T03:51:48.929Z Vendors: Joyent Products: Joyent SmartOS Problem Types: CWE-416 Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the SMBIOC_TREE_RELE ioctl. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute
tence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-4984. Additional Analyst Notes: - CVE Program Container: References: - https://help.joyent.com/hc/en-us/articles/360000124928 - https://zerodayinitiative.com/advisories/ZDI-18-159
CVE ID: CVE-2018-1167 State: PUBLISHED Published: 2018-04-19T02:00:00 Last Updated: 2024-08-05T03:51:48.863Z Vendors: Spotify Products: Spotify Music Player Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Spotify Music Player 1.0.69.336. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute cod
ser-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5501. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-280
CVE ID: CVE-2018-1168 State: PUBLISHED Published: 2018-02-21T14:00:00 Last Updated: 2024-08-05T03:51:48.990Z Vendors: ABB Products: ABB MicroSCADA Problem Types: CWE-284 Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of ABB MicroSCADA 9.3 with FP 1-2-3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the access controls for the installed product files. The installation procedure leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to esc
leaves critical files open to manipulation by any authenticated user. An attacker can leverage this vulnerability to escalate privileges to SYSTEM. Was ZDI-CAN-5097. Additional Analyst Notes: - CVE Program Container: References: - https://library.e.abb.com/public/7a88a74b12bb492ea138b1f2365d00f6/ABBVU-PGGA-33888_ABB_SoftwareVulnerabilityHandlingAdvisory_Rev_A.pdf?x-sign=MJfu9cHtRUUubpLAYzyWFTmW5W+mg3kZ/nm7F/Jw5HlFTQf4eNyfLAgE8HozRJEC - https://zerodayinitiative.com/advisories/ZDI-18-141
CVE ID: CVE-2018-1169 State: PUBLISHED Published: 2018-03-02T01:00:00 Last Updated: 2024-08-05T03:51:48.930Z Vendors: Amazon Products: Amazon Music Player Problem Types: CWE-78 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Amazon Music Player 6.1.5.1213. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI handlers. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code u
-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5521. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-215 - http://www.securityfocus.com/bid/103215
CVE ID: CVE-2018-1170 State: PUBLISHED Published: 2018-03-02T01:00:00 Last Updated: 2024-08-05T03:51:48.902Z Vendors: Volkswagen Products: Volkswagen Customer-Link App Problem Types: CWE-693 Description: This vulnerability allows adjacent attackers to inject arbitrary Controller Area Network messages on vulnerable installations of Volkswagen Customer-Link App 1.30 and HTC Customer-Link Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Customer-Link App and Customer-Link Bridge. The issue results from the lack of a proper protection mechanism against unauthorized firmware updates. An attacker can leverage this vulnerability to inject CAN
er protection mechanism against unauthorized firmware updates. An attacker can leverage this vulnerability to inject CAN messages. Was ZDI-CAN-5264. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-214
CVE ID: CVE-2018-1171 State: PUBLISHED Published: 2018-03-19T18:00:00 Last Updated: 2024-08-05T03:51:49.003Z Vendors: Joyent Products: Joyent SmartOS Problem Types: CWE-787 Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Joyent SmartOS release-20170803-20170803T064301Z. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the DTrace DOF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerabi
-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the host OS. Was ZDI-CAN-5106. Additional Analyst Notes: - CVE Program Container: References: - https://help.joyent.com/hc/en-us/articles/360000608188 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.securitytracker.com/id/1041303 - http://www.securityfocus.com/bid/104799 - https://zerodayinitiative.com/advisories/ZDI-18-236
CVE ID: CVE-2018-1172 State: PUBLISHED Published: 2018-05-16T21:00:00 Last Updated: 2024-08-05T03:51:48.966Z Vendors: The Squid Software Foundation Products: The Squid Software Foundation Squid Problem Types: CWE-476 Description: This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088
ttacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-309 - http://www.squid-cache.org/Advisories/SQUID-2018_3.txt
CVE ID: CVE-2018-1173 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:48.931Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the XFA borderColor attribute. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code u
of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5436. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-311
CVE ID: CVE-2018-1174 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:48.896Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-665 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the bitmapDPI attribute of PrintParams objects. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabi
proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5437. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-312 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-1175 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:48.925Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-665 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the interactive attribute of PrintParams objects. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnera
f proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5438. Additional Analyst Notes: - CVE Program Container: References: - https://zerodayinitiative.com/advisories/ZDI-18-313 - https://www.foxitsoftware.com/support/security-bulletins.php
CVE ID: CVE-2018-1176 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:48.997Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-787 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of ePub files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code
h can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5442. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-314
CVE ID: CVE-2018-1177 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:49.051Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the addAnnot method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the c
ct prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5488. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-315
CVE ID: CVE-2018-1178 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:48.924Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the addField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the c
ct prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5489. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-316
CVE ID: CVE-2018-1179 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:48.992Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-125 Description: This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DataSubBlock structures in GIF images. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can l
idation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-5490. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-317
CVE ID: CVE-2018-1180 State: PUBLISHED Published: 2018-05-17T15:00:00 Last Updated: 2024-08-05T03:51:48.982Z Vendors: Foxit Products: Foxit Reader Problem Types: CWE-416 Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.0.0.29935. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the AFSimple_Calculate method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context
or to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the current process. Was ZDI-CAN-5491. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxitsoftware.com/support/security-bulletins.php - https://zerodayinitiative.com/advisories/ZDI-18-318
CVE ID: CVE-2018-1181 State: REJECTED Published: 2018-12-28T22:00:00 Last Updated: 2018-12-28T21:57:01 Description: No description available.
CVE ID: CVE-2018-1182 State: PUBLISHED Published: 2018-03-08T15:00:00 Last Updated: 2024-08-05T03:51:48.991Z Vendors: n/a Products: EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only) Problem Types: Privilege Escalation Vulnerability Description: An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all p
erability Description: An issue was discovered in EMC RSA Identity Governance and Lifecycle versions 7.0.1, 7.0.2, all patch levels (hardware appliance and software bundle deployments only); RSA Via Lifecycle and Governance version 7.0, all patch levels (hardware appliance and software bundle deployments only); RSA Identity Management & Governance (RSA IMG) versions 6.9.0, 6.9.1, all patch levels (hardware appliance and software bundle deployments only). It allows certain OS level users to execute arbitrary scripts with root level privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040458 - http://www.securityfocus.com/bid/103317 -
Program Container: References: - http://www.securitytracker.com/id/1040458 - http://www.securityfocus.com/bid/103317 - http://seclists.org/fulldisclosure/2018/Mar/16
CVE ID: CVE-2018-1183 State: PUBLISHED Published: 2018-04-30T20:00:00Z Last Updated: 2024-09-16T17:58:56.361Z Vendors: Dell EMC Products: Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC Solutions Enabler Virtual Appliance, Dell EMC VASA Provider Virtual Appliance, Dell EMC SMIS, Dell EMC VMAX Embedded Management (eManagement), Dell EMC VNX2 Operating Environment (OE) for File, Dell EMC VNX2 Operating Environment (OE) for Block, Dell EMC VNX1 Operating Environment (OE) for File, Dell EMC VNX1 Operating Environment (OE) for Block, Dell EMC VNXe3200 Operating Environment (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC
nt (OE), Dell EMC VNXe1600 Operating Environment (OE), Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), Dell EMC ViPR SRM, Dell EMC ViPR SRM, Dell EMC XtremIO, Dell EMC VMAX eNAS, Dell EMC Unity Operating Environment (OE) Problem Types: XXE injection vulnerability Description: In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, Dell EMC SMIS versions prior to 8.4.0.6, Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior
eManagement) versions prior to and including 1.4.0.347, Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, Dell EMC VNXe3200 Operating Environment (OE) all versions, Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC V
l versions, Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 (only if using Dell EMC Host Interface for Windows), Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 (only if using Dell EMC Host Interface for Windows), Dell EMC XtremIO versions 4.x, Dell EMC VMAX eNAS version 8.x, Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, ECOM is affected by a XXE injection vulnerability due to the configuration of the XML parser shipped with the product. XXE Injection attack may occur when XML input containing a reference to an external entity (defined by the attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to fil
e attacker) is processed by an affected XML parser. XXE Injection may allow attackers to gain unauthorized access to files containing sensitive information or may be used to cause denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Apr/61 - http://www.securityfocus.com/bid/104024