Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-15355 State: PUBLISHED Published: 2018-08-17T14:00:00 Last Updated: 2024-08-05T09:54:01.937Z Vendors: Kaspersky Lab Products: Kraftway Problem Types: Usage of SSLv2 and SSLv3 leads to transmitted data decryption Description: Usage of SSLv2 and SSLv3 leads to transmitted data decryption in Kraftway 24F2XG Router firmware 3.5.30.1118. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/08/17/klcert-18-011-kraftway-24f2xg-router-outdated-certificate-usage/
CVE ID: CVE-2018-15356 State: PUBLISHED Published: 2018-08-17T15:00:00 Last Updated: 2024-08-05T09:54:02.435Z Vendors: Kaspersky Lab Products: Eltex ESP-200 Problem Types: An authenticated attacker can execute arbitrary code using command ejection Description: An authenticated attacker can execute arbitrary code using command ejection in Eltex ESP-200 firmware version 1.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/08/17/klcert-18-012-eltex-esp-200-router-command-injection/
CVE ID: CVE-2018-15357 State: PUBLISHED Published: 2018-08-17T15:00:00 Last Updated: 2024-08-05T09:54:01.805Z Vendors: Kaspersky Lab Products: Eltex ESP-200 Problem Types: An authenticated attacker with low privileges can extract password hash information for all users Description: An authenticated attacker with low privileges can extract password hash information for all users in Eltex ESP-200 firmware version 1.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/08/17/klcert-18-013-eltex-esp-200-router-information-disclosure/
CVE ID: CVE-2018-15358 State: PUBLISHED Published: 2018-08-17T15:00:00 Last Updated: 2024-08-05T09:54:01.992Z Vendors: Kaspersky Lab Products: Eltex ESP-200 Problem Types: An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface Description: An authenticated attacker with low privileges can activate high privileged user and use it to expand attack surface in Eltex ESP-200 firmware version 1.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/08/17/klcert-18-014-eltex-esp-200-router-build-in-user-with-highest-privileges/
CVE ID: CVE-2018-15359 State: PUBLISHED Published: 2018-08-17T15:00:00 Last Updated: 2024-08-05T09:54:03.461Z Vendors: Kaspersky Lab Products: Eltex ESP-200 Problem Types: An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface Description: An authenticated attacker with low privileges can use insecure sudo configuration to expand attack surface in Eltex ESP-200 firmware version 1.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/08/17/klcert-18-015-eltex-esp-200-router-unsecure-sudo-configuration/
CVE ID: CVE-2018-15360 State: PUBLISHED Published: 2018-08-17T15:00:00 Last Updated: 2024-08-05T09:54:03.404Z Vendors: Kaspersky Lab Products: Eltex ESP-200 Problem Types: An attacker without authentication can login with default credentials for privileged users Description: An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/08/17/klcert-18-016-eltex-esp-200-router-default-password-usage/
CVE ID: CVE-2018-15361 State: PUBLISHED Published: 2019-03-05T15:00:00Z Last Updated: 2024-09-16T17:07:56.107Z Vendors: UltraVNC Products: UltraVNC Problem Types: CWE-124 Description: UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution. This attack appears to be exploitable via network connectivity. This vulnerability has been fixed in revision 1199. Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2019/03/01/klcert-19-003-ultravnc-buffer-underwrite/ - https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf - https://www.us-cert.gov/ics
travnc-buffer-underwrite/ - https://cert-portal.siemens.com/productcert/pdf/ssa-927095.pdf - https://www.us-cert.gov/ics/advisories/icsa-20-161-06
CVE ID: CVE-2018-15362 State: PUBLISHED Published: 2018-12-07T16:00:00 Last Updated: 2024-08-05T09:54:03.813Z Vendors: n/a Products: GE Proficy Cimplicity GDS Problem Types: XXE Description: XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0 Additional Analyst Notes: - CVE Program Container: References: - https://ics-cert.us-cert.gov/advisories/ICSA-18-340-01 - http://www.securityfocus.com/bid/106133 - https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/07/klcert-18-025-general-electric-proficy-gds-xml-external-entity-xxe/
CVE ID: CVE-2018-15363 State: PUBLISHED Published: 2018-08-30T19:00:00 Last Updated: 2024-08-05T09:54:03.364Z Vendors: Trend Micro Products: Trend Micro Security (Consumer) Problem Types: Privilege Escalation Description: An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx - https://www
m Container: References: - https://esupport.trendmicro.com/en-US/home/pages/technical-support/1120742.aspx - https://www.zerodayinitiative.com/advisories/ZDI-18-963/
CVE ID: CVE-2018-15364 State: PUBLISHED Published: 2018-08-30T19:00:00 Last Updated: 2024-08-05T09:54:02.358Z Vendors: Trend Micro Products: Trend Micro OfficeScan Problem Types: Information Disclosure Description: A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-18-964/ - https://succ
st Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-18-964/ - https://success.trendmicro.com/solution/1120678
CVE ID: CVE-2018-15365 State: PUBLISHED Published: 2018-09-28T17:00:00 Last Updated: 2024-08-05T09:54:03.557Z Vendors: Trend Micro Products: Trend Micro Deep Discovery Inspector Problem Types: Reflected XSS Description: A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://success.trendmicro.com/solution/1121079 - https://github.com/nixwizard/CVE-2018-15365/
CVE ID: CVE-2018-15366 State: PUBLISHED Published: 2018-10-23T14:00:00 Last Updated: 2024-08-05T09:54:03.416Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac (Consumer) Problem Types: Privilege Escalation Description: A UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://esupport.trendmicro.com/solution/ja-jp
ability. Additional Analyst Notes: - CVE Program Container: References: - https://esupport.trendmicro.com/solution/ja-jp/1121350.aspx - http://www.securityfocus.com/bid/105757 - https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.aspx - https://www.zerodayinitiative.com/advisories/ZDI-18-1293/
CVE ID: CVE-2018-15367 State: PUBLISHED Published: 2018-10-23T14:00:00 Last Updated: 2024-08-05T09:54:03.402Z Vendors: Trend Micro Products: Trend Micro Antivirus for Mac (Consumer) Problem Types: Privilege Escalation Description: A ctl_set KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://esupport.trendmicro.com/soluti
s vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://esupport.trendmicro.com/solution/ja-jp/1121350.aspx - https://www.zerodayinitiative.com/advisories/ZDI-18-1294/ - http://www.securityfocus.com/bid/105757 - https://esupport.trendmicro.com/en-US/home/pages/technical-support/1121296.aspx
CVE ID: CVE-2018-15368 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:36:33.761Z Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-20 Description: A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent modifications to the underlying Linux filesystem on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit t
on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-privesc
CVE ID: CVE-2018-15369 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:36:25.494Z Vendors: Cisco Products: Cisco IOS Software Problem Types: CWE-20 Description: A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of crafted TACACS+ response packets by the affected software. An attacker could exploit this vulnerability by injecting a crafted TACACS+ packet into an existing TACACS+ session between an affected device and a TACACS+ server or by
njecting a crafted TACACS+ packet into an existing TACACS+ session between an affected device and a TACACS+ server or by impersonating a known, valid TACACS+ server and sending a crafted TACACS+ packet to an affected device when establishing a connection to the device. To exploit this vulnerability by using either method, the attacker must know the shared TACACS+ secret and the crafted packet must be sent in response to a TACACS+ request from a TACACS+ client. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/secur
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-tacplus - http://www.securityfocus.com/bid/105426
CVE ID: CVE-2018-15370 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:36:16.475Z Vendors: Cisco Products: Cisco Catalyst 6800 Series Switches Problem Types: CWE-264 Description: A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cisco Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to the presence of a hidden command in the affected software. An attacker could exploit this vulnerability by connecting to an affected device via the console, forcing the device into ROMMON mode, and writing a mal
ulnerability by connecting to an affected device via the console, forcing the device into ROMMON mode, and writing a malicious pattern to a specific memory address on the device. A successful exploit could allow the attacker to bypass signature validation checks by Cisco Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-catalyst6800 - http://www.securityfocus.com/bid/105412
CVE ID: CVE-2018-15371 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:36:07.393Z Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-284 Description: A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by requesting access to the root shell of an affected device, after the shell access feature has been enabled. A successfu
requesting access to the root shell of an affected device, after the shell access feature has been enabled. A successful exploit could allow the attacker to bypass authentication and gain unrestricted access to the root shell of the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-shell-access
CVE ID: CVE-2018-15372 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:35:55.702Z Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-284 Description: A vulnerability in the MACsec Key Agreement (MKA) using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic through a Layer 3 interface of an affected device. The vulnerability is due to a logic error in the affected software. An attacker could exploit this vulnerability by connecting to and passing traffic through a Layer 3 interface of an affected devic
r could exploit this vulnerability by connecting to and passing traffic through a Layer 3 interface of an affected device, if the interface is configured for MACsec MKA using EAP-TLS and is running in access-session closed mode. A successful exploit could allow the attacker to bypass 802.1x network access controls and gain access to the network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-macsec - http://www.securityfocus.com/bid/105416
CVE ID: CVE-2018-15373 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:35:45.573Z Vendors: Cisco Products: Cisco IOS Software Problem Types: CWE-399 Description: A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust memory on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper memory handling by the affected software when the software processes high rates of Cisco Discovery Protocol packets that are sent to a device. An attacker could exploit this vulnerability by sending a hi
Cisco Discovery Protocol packets that are sent to a device. An attacker could exploit this vulnerability by sending a high rate of Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to exhaust memory on the affected device, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-cdp-dos - http://www.securityfocus.com/bid/105413 - https://ics-cert.us-cert.gov/advisories/ICSA-19-094-03
CVE ID: CVE-2018-15374 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:35:34.824Z Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-347 Description: A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install a malicious software image or file on an affected device. The vulnerability is due to the affected software improperly verifying digital signatures for software images and files that are uploaded to a device. An attacker could exploit this vulnerability by uploading a malicious software image or file to an affected device. A successful exploit could allow the attacker to b
y uploading a malicious software image or file to an affected device. A successful exploit could allow the attacker to bypass digital signature verification checks for software images and files and install a malicious software image or file on the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-digsig - http://www.securityfocus.com/bid/105415
CVE ID: CVE-2018-15375 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:35:25.304Z Vendors: Cisco Products: Cisco IOS Software Problem Types: CWE-123 Description: A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affec
opment builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-ir800-memwrite
CVE ID: CVE-2018-15376 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:35:14.909Z Vendors: Cisco Products: Cisco IOS Software Problem Types: CWE-123 Description: A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affec
CVE ID: CVE-2018-15377 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:35:06.039Z Vendors: Cisco Products: Cisco IOS Software Problem Types: CWE-400 Description: A vulnerability in the Cisco Network Plug and Play agent, also referred to as the Cisco Open Plug-n-Play agent, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by sending invalid data to the Cisco Network Plug and Play agent on an affected device. A successful exploit could allow the a
ding invalid data to the Cisco Network Plug and Play agent on an affected device. A successful exploit could allow the attacker to cause a memory leak on the affected device, which could cause the device to reload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-pnp-memleak - https://ics-cert.us-cert.gov/advisories/ICSA-19-094-02
CVE ID: CVE-2018-15378 State: PUBLISHED Published: 2018-10-15T17:00:00Z Last Updated: 2024-11-26T14:26:00.813Z Vendors: Cisco Products: ClamAV Problem Types: CWE-125 Description: A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.debian.org/debian-lts-announce/2018/10/msg00014.html - https://bugzilla.clamav.ne
nrichment: References: - https://lists.debian.org/debian-lts-announce/2018/10/msg00014.html - https://bugzilla.clamav.net/show_bug.cgi?id=12170 - https://secuniaresearch.flexerasoftware.com/advisories/83000/ - https://usn.ubuntu.com/3789-2/ - https://usn.ubuntu.com/3789-1/ - https://www.flexera.com/company/secunia-research/advisories/SR-2018-23.html - https://security.gentoo.org/glsa/201904-12
CVE ID: CVE-2018-15379 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:34:54.760Z Vendors: Cisco Products: Cisco Prime Infrastructure Problem Types: CWE-275 Description: A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the privilege level of the user prime. This user does not have administrative or root privileges. The vulnerability is due to an incorrect permission setting for important system directories. An attacker could exploit this vulnerability by upload
an incorrect permission setting for important system directories. An attacker could exploit this vulnerability by uploading a malicious file by using TFTP, which can be accessed via the web-interface GUI. A successful exploit could allow the attacker to run commands on the targeted application without authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/45555/ - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-pi-tftp - http://www.securityfocus.com/bid/105506 - http://www.securitytracker.com/id/1041816