Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1214 State: PUBLISHED Published: 2018-02-12T21:00:00 Last Updated: 2024-08-05T03:51:48.983Z Vendors: n/a Products: Dell SupportAssist Enterprise version 1.1 Problem Types: undocumented default account Description: Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achieved by someone with knowledge of the default password. If SupportAssist Enterprise is installed on a server running OpenManage Essentials (OME), the OmeAdapterUser user acco
. If SupportAssist Enterprise is installed on a server running OpenManage Essentials (OME), the OmeAdapterUser user account is added as a member of the OmeAdministrators group for the OME. An unauthorized person with knowledge of the default password and access to the OME web console could potentially use this account to gain access to the affected installation of OME with OmeAdministrators privileges. This is fixed in version 1.2.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.dell.com/support/article/us/en/04/sln308843/dell-emc-supportassist-enterprise-server-storage-networking-undocumented-default-account-vulnerability
CVE ID: CVE-2018-1215 State: PUBLISHED Published: 2018-03-08T15:00:00 Last Updated: 2024-08-05T03:51:48.929Z Vendors: n/a Products: vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) Problem Types: Arbitrary file upload vulnerability Description: An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions
d Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). A remote authenticated malicious user may potentially upload arbitrary maliciously crafted files in any location on the web server. By chaining this vulnerability with CVE-2018-1216, the attacker may use the default account to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://w
default account to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103039 - https://www.tenable.com/security/research/tra-2018-03 - http://www.securitytracker.com/id/1040383 - http://seclists.org/fulldisclosure/2018/Feb/41
CVE ID: CVE-2018-1216 State: PUBLISHED Published: 2018-03-08T15:00:00 Last Updated: 2024-08-05T03:51:49.053Z Vendors: n/a Products: vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) Problem Types: Hard-coded password vulnerability Description: A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enab
agement (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). They contain an undocumented default account (smc) with a hard-coded password that may be used with certain web servlets. A remote attacker with the knowledge of the hard-coded password and the message format may use vulnerable servlets to gain unauthorized access to the system. Note: This account cannot be used to log in via the w
use vulnerable servlets to gain unauthorized access to the system. Note: This account cannot be used to log in via the web user interface. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103039 - https://www.tenable.com/security/research/tra-2018-03 - http://www.securitytracker.com/id/1040383 - http://seclists.org/fulldisclosure/2018/Feb/41
CVE ID: CVE-2018-1217 State: PUBLISHED Published: 2018-04-09T20:00:00Z Last Updated: 2024-09-16T19:47:17.864Z Vendors: Dell EMC Products: Avamar, Integrated Data Protection Appliance Problem Types: Missing Access Control Vulnerability Description: Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid
he LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44441/ - http://www.securitytracker.com/id/1040641 - http://seclists.org/fulldisclosure/2018/Apr/14
CVE ID: CVE-2018-1218 State: PUBLISHED Published: 2018-03-19T18:00:00Z Last Updated: 2024-09-17T02:16:47.701Z Vendors: Dell EMC Products: Dell EMC NetWorker Problem Types: Buffer Overflow Vulnerability Description: In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes a buffer overflow condition when handling certain messages. A remote unauthenticated attacker could potentially exploit this vulnerability to cause a denial of service to the users of NetWorker systems. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040546 - http://seclists.org/fulldisclosur
es: - CVE Program Container: References: - http://www.securitytracker.com/id/1040546 - http://seclists.org/fulldisclosure/2018/Mar/43 - https://www.exploit-db.com/exploits/44332/
CVE ID: CVE-2018-1219 State: PUBLISHED Published: 2018-03-08T15:00:00 Last Updated: 2024-08-05T03:51:48.990Z Vendors: n/a Products: EMC RSA Archer GRC Platform RSA Archer versions prior to 6.2.0.8 Problem Types: Improper Access Control Description: EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user information. A remote authenticated malicious user can potentially exploit this vulnerability to gather information about the user base and may use this information in subsequent attacks. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/12 - http://www.sec
al Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/12 - http://www.securityfocus.com/bid/103319 - http://www.securitytracker.com/id/1040457
CVE ID: CVE-2018-1220 State: PUBLISHED Published: 2018-03-08T15:00:00 Last Updated: 2024-08-05T03:51:48.903Z Vendors: n/a Products: EMC RSA Archer GRC Platform RSA Archer versions prior to 6.2.0.8 Problem Types: URL Redirection to Untrusted Site Description: EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/12 - http://www.securityfocus.com/bid/103319 - http:/
ntainer: References: - http://seclists.org/fulldisclosure/2018/Mar/12 - http://www.securityfocus.com/bid/103319 - http://www.securitytracker.com/id/1040457
CVE ID: CVE-2018-1221 State: PUBLISHED Published: 2018-03-19T18:00:00Z Last Updated: 2024-09-17T01:15:36.021Z Vendors: Dell EMC Products: The Cloud Foundry Gorouter Problem Types: websocket handling vulnerability Description: In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1221/
CVE ID: CVE-2018-1222 State: REJECTED Published: 2018-09-18T20:00:00 Last Updated: 2018-09-18T19:57:01 Description: No description available.
CVE ID: CVE-2018-1223 State: PUBLISHED Published: 2018-09-17T16:00:00Z Last Updated: 2024-09-16T19:24:18.482Z Vendors: Cloud Foundry Products: Container Runtime Problem Types: Credential leak to logs Description: Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the ability to read the application logs could use these credentials to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1223/
CVE ID: CVE-2018-1224 State: REJECTED Published: 2018-03-19T20:00:00 Last Updated: 2018-03-19T19:57:01 Description: No description available.
CVE ID: CVE-2018-1225 State: REJECTED Published: 2018-03-19T20:00:00 Last Updated: 2018-03-19T19:57:01 Description: No description available.
CVE ID: CVE-2018-1226 State: REJECTED Published: 2018-03-19T20:00:00 Last Updated: 2018-03-19T19:57:01 Description: No description available.
CVE ID: CVE-2018-1227 State: PUBLISHED Published: 2018-03-13T20:00:00 Last Updated: 2024-08-05T03:51:49.041Z Vendors: n/a Products: Concourse CI: As of 2018-03-13, Pivotal does not believe that any resources or builds of Concourse have been compromised. Problem Types: Domain Issue Description: Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal. The original domain for the Concourse CI (concourse-dot-ci) open source project has been registered by an unknown actor, and is therefore no longer the official website for Concourse CI. The new official d
een registered by an unknown actor, and is therefore no longer the official website for Concourse CI. The new official domain is concourse-ci.org. At approximately 4 am EDT on March 7, 2018 the Concourse OSS team began receiving reports that the Concourse domain was not responding. The Concourse OSS team discovered, upon investigation with both the original and the new domain registrars, that the originating domain registrar had made the domain available for purchase. This was done despite the domain being renewed by the Concourse OSS team through August 2018. For a customer to be affected, they would have needed to access a download from a "concourse-dot-ci" domain web site after March 6, 2
r to be affected, they would have needed to access a download from a "concourse-dot-ci" domain web site after March 6, 2018 18:00:00 EST. Accessing that domain is NOT recommended by Pivotal. Anyone who had been using that domain should immediately begin using the concourse-ci.org domain instead. Customers can also safely access Concourse software from the traditionally available locations on the Pivotal Network or GitHub. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-1227
CVE ID: CVE-2018-1228 State: REJECTED Published: 2018-05-09T14:00:00 Last Updated: 2018-05-09T13:57:01 Description: No description available.
CVE ID: CVE-2018-1229 State: PUBLISHED Published: 2018-03-21T20:00:00Z Last Updated: 2024-09-17T03:53:07.373Z Vendors: Spring by Pivotal Products: Spring Batch Admin Problem Types: CWE-79 Description: Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103462 - https://pivotal.io/security/cve-2018-1229
CVE ID: CVE-2018-1230 State: PUBLISHED Published: 2018-03-21T20:00:00Z Last Updated: 2024-09-16T19:24:07.571Z Vendors: Spring by Pivotal Products: Spring Batch Admin Problem Types: CWE-352 Description: Pivotal Spring Batch Admin, all versions, does not contain cross site request forgery protection. A remote unauthenticated user could craft a malicious site that executes requests to Spring Batch Admin. This issue has not been patched because Spring Batch Admin has reached end of life. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-1230 - http://www.securityfocus.com/bid/103463
CVE ID: CVE-2018-1231 State: PUBLISHED Published: 2018-03-27T16:00:00Z Last Updated: 2024-09-17T00:46:05.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. A user with access to an instance using the BOSH CLI can access the BOSH CLI configuration file and use its contents to perform authenticated requests to BOSH. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1231/
CVE ID: CVE-2018-1232 State: PUBLISHED Published: 2018-03-30T21:00:00Z Last Updated: 2024-09-17T00:25:34.327Z Vendors: Dell EMC Products: RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server Problem Types: Stack-based Buffer Overflow Vulnerability Description: RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the authentication agent and cause a denial-of-service situation. Additional Analyst Notes: - CVE Program Contain
crash the authentication agent and cause a denial-of-service situation. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/60 - http://www.securitytracker.com/id/1040577
CVE ID: CVE-2018-1233 State: PUBLISHED Published: 2018-03-30T21:00:00Z Last Updated: 2024-09-16T19:56:31.343Z Vendors: Dell EMC Products: RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server Problem Types: Cross-site Scripting Vulnerability Description: RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website. Additional Analyst Notes: - CVE Program Container: References: - http://seclists
in the context of the affected website. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/60 - http://www.securitytracker.com/id/1040577
CVE ID: CVE-2018-1234 State: PUBLISHED Published: 2018-03-30T21:00:00Z Last Updated: 2024-09-16T18:44:10.804Z Vendors: Dell EMC Products: RSA Authentication Agent for Web for IIS Problem Types: Sensitive Information Disclosure Vulnerability Description: RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to read configuration properties for the authentication agent. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/f
ies for the authentication agent. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/60 - http://www.securitytracker.com/id/1040577
CVE ID: CVE-2018-1235 State: PUBLISHED Published: 2018-05-29T17:00:00Z Last Updated: 2024-09-16T19:20:40.439Z Vendors: Dell EMC Products: Dell EMC RecoverPoint, Dell EMC RecoverPoint Virtual Machine (VM) Problem Types: command injection vulnerability Description: Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/61 - https://www.exploit-db.com/ex
s: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/61 - https://www.exploit-db.com/exploits/44920/ - http://www.securityfocus.com/bid/104246
CVE ID: CVE-2018-1236 State: REJECTED Published: 2018-08-17T17:00:00 Last Updated: 2018-08-17T16:57:01 Description: No description available.
CVE ID: CVE-2018-1237 State: PUBLISHED Published: 2018-03-27T21:00:00Z Last Updated: 2024-09-17T04:04:20.164Z Vendors: Dell EMC Products: ScaleIO Problem Types: Improper Restriction of Excessive Authentication Attempts Vulnerability Description: Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having network access to LIA, could potentially exploit this vulnerability to launch brute force guessing of user names and passwords of user accounts on the LIA. Ad
ly exploit this vulnerability to launch brute force guessing of user names and passwords of user accounts on the LIA. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/59
CVE ID: CVE-2018-1238 State: PUBLISHED Published: 2018-03-27T21:00:00Z Last Updated: 2024-09-16T20:06:14.715Z Vendors: Dell EMC Products: ScaleIO Problem Types: Command injection vulnerability Description: Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge of the LIA administrative password, could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed. Additional Analyst Notes: - CVE Progra
bility to run arbitrary commands as root on the systems where LIAs are installed. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Mar/59
CVE ID: CVE-2018-1239 State: PUBLISHED Published: 2018-05-08T13:00:00Z Last Updated: 2024-09-16T16:33:38.146Z Vendors: Dell EMC Products: Unity Operating Environment (OE) Problem Types: OS command injection vulnerabilities Description: Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/15 - http://www.securityfocus.com/bid/10
VE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/15 - http://www.securityfocus.com/bid/104092
CVE ID: CVE-2018-1240 State: PUBLISHED Published: 2018-04-18T16:00:00Z Last Updated: 2024-09-16T20:31:57.816Z Vendors: Dell EMC Products: ViPR Controller Problem Types: Information Exposure Vulnerability Description: Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system. Addition
and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/Apr/29
CVE ID: CVE-2018-1241 State: PUBLISHED Published: 2018-05-29T17:00:00Z Last Updated: 2024-09-17T01:21:43.931Z Vendors: Dell EMC Products: Dell EMC RecoverPoint, Dell EMC RecoverPoint Virtual Machine (VM) Problem Types: CWE-532 Description: Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-text into the RecoverPoint log file. An authenticated malicious user with access to the RecoverPoint log files may obtain the exposed LDAP password to use it in further attacks. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/61 - http://www.s
onal Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/61 - http://www.securityfocus.com/bid/104246
CVE ID: CVE-2018-1242 State: PUBLISHED Published: 2018-05-29T17:00:00Z Last Updated: 2024-09-16T20:32:13.130Z Vendors: Dell EMC Products: Dell EMC RecoverPoint, Dell EMC RecoverPoint Virtual Machine (VM) Problem Types: command injection vulnerability Description: Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclos
mission cannot be read. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/61 - http://www.securityfocus.com/bid/104246
CVE ID: CVE-2018-1243 State: PUBLISHED Published: 2018-07-02T17:00:00Z Last Updated: 2024-09-16T19:20:22.599Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: iDRAC6, iDRAC7, iDRAC8 Problem Types: Weak CGI session ID vulnerability. Description: Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks. Additional Analyst Notes: - CVE Program Container: References