Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
sts/oss-security/2019/07/06/4 - https://support.f5.com/csp/article/K74374841?utm_source=f5support&amp%3Butm_medium=RSS - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200115-01-linux-en - https://cert-portal.siemens.com/productcert/pdf/ssa-377115.pdf
CVE ID: CVE-2018-5392 State: PUBLISHED Published: 2018-08-14T16:00:00 Last Updated: 2024-08-05T05:33:44.301Z Vendors: mingw Products: mingw-w64 Problem Types: CWE-824 Description: mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR. ASLR is an exploit mitigation technique used by modern Windows platforms. For ASLR to function, Windows executables must contain a relocations table. Despite containing the "Dynamic base" PE header, which indicates ASLR compatibility, Windows executables produced by mingw-w64 have the relocations table stripped from them by default. This means that executables produced by mingw-w64 are vulnerable to return
ocations table stripped from them by default. This means that executables produced by mingw-w64 are vulnerable to return-oriented programming (ROP) attacks. Windows executables generated by mingw-w64 claim to be ASLR compatible, but are not. Vulnerabilities in such executables are more easily exploitable as a result. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/307144
CVE ID: CVE-2018-5393 State: PUBLISHED Published: 2018-09-28T17:00:00 Last Updated: 2024-08-05T05:33:44.241Z Vendors: TP-LINK Products: EAP Controller Problem Types: CWE-306 Description: The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method invocation (RMI) service for remote control. The RMI interface does not require any authentication before use, so it lacks user authentication for RMI service commands in EAP controller versions 2.5.3 and earlier. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target se
ation attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/581311 - http://www.securityfocus.com/bid/105402
CVE ID: CVE-2018-5399 State: PUBLISHED Published: 2018-10-08T15:00:00Z Last Updated: 2024-09-17T00:11:46.657Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Auto-Maskin Products: DCU-210E, RP-210E Problem Types: CWE-798 Description: The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is running. The Dropbear server is configured with a hard-coded user name and password combination of root / amroot. The server is configured to use password only authentication not cryptographic keys, however the firmware image contains an RSA host-key for the server. An attacker can exploit
ion not cryptographic keys, however the firmware image contains an RSA host-key for the server. An attacker can exploit this vulnerability to gain root access to the Angstrom Linux operating system and modify any binaries or configuration files in the firmware. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/176301 - https://www.us-cert.gov/ics/advisories/icsa-20-051-04
CVE ID: CVE-2018-5400 State: PUBLISHED Published: 2018-10-08T15:00:00Z Last Updated: 2024-09-16T18:08:45.736Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Auto-Maskin Products: DCU-210E, RP-210E, Marine Pro Observer Android App Problem Types: CWE-346 Description: The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, "Hello World" over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LA
to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/176301 - h
.7 on ARMv7. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/176301 - https://www.us-cert.gov/ics/advisories/icsa-20-051-04
CVE ID: CVE-2018-5401 State: PUBLISHED Published: 2018-10-08T15:00:00Z Last Updated: 2024-09-17T03:37:46.527Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Auto-Maskin Products: DCU-210E, RP-210E, Marine Pro Observer Android App Problem Types: CWE-319 Description: The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App transmit sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. The devices transmit process control information via unencrypted Modbus communications. Impact: An attacker can exploit this vulnerability to observe information about configurations, settings, wha
nications. Impact: An attacker can exploit this vulnerability to observe information about configurations, settings, what sensors are present and in use, and other information to aid in crafting spoofed messages. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/176301 - https://www.us-cert.gov/ics/advisories/icsa-20-051-04
CVE ID: CVE-2018-5402 State: PUBLISHED Published: 2018-10-08T15:00:00Z Last Updated: 2024-09-16T17:28:38.924Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Auto-Maskin Products: DCU-210E, RP-210E Problem Types: CWE-319 Description: The Auto-Maskin DCU 210E, RP-210E, and Marine Pro Observer Android App use an embedded webserver that uses unencrypted plaintext for the transmission of the administrator PIN Impact: An attacker once authenticated can change configurations, upload new configuration files, and upload executable code via file upload for firmware updates. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and the
pload for firmware updates. Requires access to the network. Affected releases are Auto-Maskin DCU-210E, RP-210E, and the Marine Pro Observer Android App. Versions prior to 3.7 on ARMv7. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/176301 - https://www.us-cert.gov/ics/advisories/icsa-20-051-04
CVE ID: CVE-2018-5403 State: PUBLISHED Published: 2019-01-10T22:00:00 Last Updated: 2024-08-05T05:33:44.444Z Vendors: Imperva Products: SecureSphere Problem Types: CWE-77 Description: Imperva SecureSphere gateway (GW) running v13, for both pre-First Time Login or post-First Time Login (FTL), if the attacker knows the basic authentication passwords, the GW may be vulnerable to RCE through specially crafted requests, from the web access management interface. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45542
CVE ID: CVE-2018-5404 State: PUBLISHED Published: 2019-06-03T18:23:52 Last Updated: 2024-08-05T05:33:44.447Z Vendors: Quest Kace Products: K1000 Appliance Problem Types: CWE-89 Description: The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated, remote attacker with least privileges ('User Console Only' role) to potentially exploit multiple Blind SQL Injection vulnerabilities to retrieve sensitive information from the database or copy the entire database. An authenticated remote attacker could leverage Blind SQL injections to obtain sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/877837/ - https://su
a. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/877837/ - https://support.quest.com/kb/288310/cert-coordination-center-report-update
CVE ID: CVE-2018-5405 State: PUBLISHED Published: 2019-06-03T18:23:49 Last Updated: 2024-08-05T05:33:44.381Z Vendors: Quest Kace Products: K1000 Appliance Problem Types: CWE-79 Description: The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before
o launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with 'user console only' rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/877837/ - https://support.quest.com/kb/288310/cer
- CVE Program Container: References: - https://www.kb.cert.org/vuls/id/877837/ - https://support.quest.com/kb/288310/cert-coordination-center-report-update - http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html
CVE ID: CVE-2018-5406 State: PUBLISHED Published: 2019-06-03T18:23:46 Last Updated: 2024-08-05T05:33:44.407Z Vendors: Quest Kace Products: K1000 Appliance Problem Types: CWE-284 Description: The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows a remote attacker to exploit the misconfigured Cross-Origin Resource Sharing (CORS) mechanism. An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. A malicious internal user could also gain administrator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. This could ca
trator privileges of this appliance and use it to visit a malicious link that exploits this vulnerability. This could cause the application to perform sensitive actions such as adding a new administrator account or changing the appliance’s settings. An unauthenticated, remote attacker could add an administrator-level account or change the appliance's settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/877837/ - https://support.quest.com/kb/288310/cert-coordination-center-report-update - http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html
CVE ID: CVE-2018-5407 State: PUBLISHED Published: 2018-11-15T21:00:00 Last Updated: 2024-08-05T05:33:44.232Z Vendors: N/A Products: Processors supporting Simultaneous Multi-Threading Problem Types: CWE-200 Description: Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:0483 - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://security.netapp.com/advisory/ntap-20181126-0001/ - https://usn.ubuntu.com/3840-1/ - https://www.debian.
1.html - https://security.netapp.com/advisory/ntap-20181126-0001/ - https://usn.ubuntu.com/3840-1/ - https://www.debian.org/security/2018/dsa-4355 - https://www.tenable.com/security/tns-2018-17 - https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ - https://security.gentoo.org/glsa/201903-10 - https://www.tenable.com/security/tns-2018-16 - https://www.exploit-db.com/exploits/45785/ - https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html - https://github.com/bbbrumley/portsmash - https://www.debian.org/security/2018/dsa-4348 - http://www.securityfocus.com/bid/105897 - https://eprint.iacr.org/2018/1060.pdf - https://access.redhat.com/errata/RHSA-2019:0651 - h
curityfocus.com/bid/105897 - https://eprint.iacr.org/2018/1060.pdf - https://access.redhat.com/errata/RHSA-2019:0651 - https://access.redhat.com/errata/RHSA-2019:0652 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://access.redhat.com/errata/RHSA-2019:2125 - https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%3Butm_medium=RSS - https://access.redhat.com/errata/RHSA-2019:3929 - https://access.redhat.com/errata/RHSA-2019:3933 - https://access.redhat.com/errata/RHSA-2019:3931 - https://access.redhat.com/errata/RHSA-2019:3935 - https://access.redhat.com/errata/R
.redhat.com/errata/RHSA-2019:3931 - https://access.redhat.com/errata/RHSA-2019:3935 - https://access.redhat.com/errata/RHSA-2019:3932 - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-5408 State: PUBLISHED Published: 2019-05-08T14:48:20 Last Updated: 2024-08-05T05:33:44.367Z Vendors: PrinterLogic Products: Management Software Problem Types: CWE-295 Description: The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a
ing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/169249/ - http://www.securityfocus.com/bid/108285
CVE ID: CVE-2018-5409 State: PUBLISHED Published: 2019-05-08T14:48:20 Last Updated: 2024-08-05T05:33:44.353Z Vendors: PrinterLogic Products: Management Software Problem Types: CWE-494 Description: The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/169249/ - http://www.securityfocus.com/bid/108285
CVE ID: CVE-2018-5410 State: PUBLISHED Published: 2019-01-07T14:00:00 Last Updated: 2024-08-05T05:33:44.211Z Vendors: Dokan Products: Open Source File System Problem Types: CWE-121 Description: Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.5000 version update. Additional Analyst Notes: - CVE Program Container: References: - https://kb.cert.org/vuls/id/741315/ - https://www.exploit-db.com/exploits/46155/ - https://cwe.mitre.org/data/definitions/121.
//kb.cert.org/vuls/id/741315/ - https://www.exploit-db.com/exploits/46155/ - https://cwe.mitre.org/data/definitions/121.html - https://github.com/dokan-dev/dokany/releases/tag/v1.2.1.1000 - http://www.securityfocus.com/bid/106274
CVE ID: CVE-2018-5411 State: PUBLISHED Published: 2018-12-13T22:00:00 Last Updated: 2024-08-05T05:33:44.412Z Vendors: Pixar Products: Tractor Problem Types: CWE-79 Description: Pixar's Tractor software, versions 2.2 and earlier, contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user. An attacker might include Javascript that could execute on an authenticated user's system that could lead to website redirects, session cookie hijacking, social
t could execute on an authenticated user's system that could lead to website redirects, session cookie hijacking, social engineering, etc. As this is stored with the information about the node, all other authenticated users with access to this data are also vulnerable. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106209 - https://www.kb.cert.org/vuls/id/756913/
CVE ID: CVE-2018-5412 State: PUBLISHED Published: 2019-01-10T22:00:00 Last Updated: 2024-08-05T05:33:44.408Z Vendors: Imperva Products: SecureSphere Problem Types: CWE-77 Description: Imperva SecureSphere running v12.0.0.50 is vulnerable to local arbitrary code execution, escaping sealed-mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45132
CVE ID: CVE-2018-5413 State: PUBLISHED Published: 2019-01-10T22:00:00 Last Updated: 2024-08-05T05:33:44.378Z Vendors: Imperva Products: SecureSphere Problem Types: CWE-250 Description: Imperva SecureSphere running v13.0, v12.0, or v11.5 allows low privileged users to add SSH login keys to the admin user, resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45130
CVE ID: CVE-2018-5414 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5415 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5416 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5417 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5418 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5419 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5420 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5421 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5422 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5423 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5424 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5425 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5426 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5427 State: REJECTED Published: 2019-03-05T20:00:00 Last Updated: 2019-03-05T19:57:01 Description: No description available.
CVE ID: CVE-2018-5428 State: PUBLISHED Published: 2018-06-20T18:00:00Z Last Updated: 2024-09-16T17:48:24.850Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO Data Virtualization Problem Types: The impact of the vulnerability includes the theoretical possibility of disclosing contents of files on the host machine that are accessible to the operating system account used to run the affected component. Description: The version control adapters component of TIBCO Data Virtualization (formerly known as Cisco Information Server) contains vulnerabilities that may allow for arbitrary command execution. Affected releases are TIBCO Dat
rmation Server) contains vulnerabilities that may allow for arbitrary command execution. Affected releases are TIBCO Data Virtualization: 7.0.5; 7.0.6. Additional Analyst Notes: - CVE Program Container: References: - https://www.tibco.com/support/advisories/2018/06/tibco-security-advisory-june-20-2018-tibco-data-virtualization - http://www.securityfocus.com/bid/104518
CVE ID: CVE-2018-5429 State: PUBLISHED Published: 2018-04-17T18:00:00Z Last Updated: 2024-09-17T00:32:19.534Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: TIBCO Software Inc. Products: TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, TIBCO Jaspersoft Studio for ActiveMatrix BPM Problem Types: The impa
Studio, TIBCO Jaspersoft Studio Community Edition, TIBCO Jaspersoft Studio for ActiveMatrix BPM Problem Types: The impact of this vulnerability includes the possibility of arbitrary code execution with the privileges of the operation system process that contains the affected component. Description: A vulnerability in the report scripting component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and
JasperReports Library for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, TIBCO Jaspersoft Reporting and Analytics for AWS, TIBCO Jaspersoft Studio, TIBCO Jaspersoft Studio Community Edition, and TIBCO Jaspersoft Studio for ActiveMatrix BPM may allow analytic reports that contain scripting to perform arbitrary code execution. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2;6.3.3; 6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO JasperReports Library: versions up to