Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-27053 State: PUBLISHED Published: 2020-12-15T16:06:44 Last Updated: 2024-08-04T16:11:35.707Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In broadcastWifiCredentialChanged of ClientModeImpl.java, there is a possible location permission bypass due to a missing permission check. This could lead to local information disclosure of the WiFi network name with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-159371448 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2020-12-01
CVE ID: CVE-2020-27054 State: PUBLISHED Published: 2020-12-15T16:06:51 Last Updated: 2024-08-04T16:11:35.397Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In onFactoryReset of BluetoothManagerService.java, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-159061926 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2020-12-01
CVE ID: CVE-2020-27055 State: PUBLISHED Published: 2020-12-15T16:07:36 Last Updated: 2024-08-04T16:11:35.398Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In isSubmittable and showWarningMessagesIfAppropriate of WifiConfigController.java and WifiConfigController2.java, there is a possible insecure WiFi configuration due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-161378819 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulle
: A-161378819 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2020-12-01
CVE ID: CVE-2020-27056 State: PUBLISHED Published: 2020-12-15T16:17:00 Last Updated: 2024-08-04T16:11:35.624Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In SELinux policies of mls, there is a missing permission check. This could lead to local information disclosure of package metadata with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-161356067 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2020-12-01
CVE ID: CVE-2020-27057 State: PUBLISHED Published: 2020-12-15T16:17:06 Last Updated: 2024-08-04T16:11:35.387Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In getGpuStatsGlobalInfo and getGpuStatsAppInfo of GpuService.cpp, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of gpu statistics with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-161903239 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2020-12-01
CVE ID: CVE-2020-27059 State: PUBLISHED Published: 2021-01-11T20:28:56 Last Updated: 2024-08-04T16:11:35.475Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In onAuthenticated of AuthenticationClient.java, there is a possible tapjacking attack when requesting the user's fingerprint due to an overlaid window. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.0, Android-8.1, Android-9, Android-10, 11; Android ID: A-159249069. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bullet
A-159249069. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2021-01-01
CVE ID: CVE-2020-27066 State: PUBLISHED Published: 2020-12-15T16:17:13 Last Updated: 2024-08-04T16:11:35.932Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In xfrm6_tunnel_free_spi of net/ipv6/xfrm6_tunnel.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-168043318 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2020-12-01
CVE ID: CVE-2020-27067 State: PUBLISHED Published: 2020-12-15T16:17:19 Last Updated: 2024-08-04T16:11:35.535Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In the l2tp subsystem, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152409173 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2020-12-01
CVE ID: CVE-2020-27068 State: PUBLISHED Published: 2020-12-15T16:17:26 Last Updated: 2024-08-04T16:11:35.394Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: Product: AndroidVersions: Android kernelAndroid ID: A-127973231References: Upstream kernel Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/pixel/2022-06-01
CVE ID: CVE-2020-27097 State: PUBLISHED Published: 2021-01-22T19:15:53 Last Updated: 2024-08-04T16:11:35.435Z Vendors: n/a Products: Android Problem Types: Information disclosure Description: In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-140729426 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/android-11
CVE ID: CVE-2020-27098 State: PUBLISHED Published: 2021-01-22T19:16:05 Last Updated: 2024-08-04T16:11:35.377Z Vendors: n/a Products: Android Problem Types: Elevation of privilege Description: In checkGrantUriPermission of UriGrantsManagerService.java, there is a possible way to access contacts due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-138791358 Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/android-11
CVE ID: CVE-2020-27121 State: PUBLISHED Published: 2020-11-06T18:15:38.587985Z Last Updated: 2024-11-13T17:44:46.213Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Cisco Products: Cisco Unified Communications Manager IM and Presence Service Problem Types: CWE-248 Description: A vulnerability in Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) Software could allow an authenticated, remote attacker to cause the Cisco XCP Authentication Service on an affected device to restart, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of login requests. An attacker could exploit this vu
vice (DoS) condition. The vulnerability is due to improper handling of login requests. An attacker could exploit this vulnerability by sending a crafted client login request to an affected device. A successful exploit could allow the attacker to cause a process to crash, resulting in a DoS condition for new login attempts. Users who are authenticated at the time of the attack would not be affected. There are workarounds that address this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imp-dos-uTx2dqu2
CVE ID: CVE-2020-27122 State: PUBLISHED Published: 2020-11-06T18:15:43.097138Z Last Updated: 2024-11-13T17:44:36.593Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Cisco Products: Cisco Identity Services Engine Software Problem Types: CWE-266 Description: A vulnerability in the Microsoft Active Directory integration of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to elevate privileges on an affected device. To exploit this vulnerability, an attacker would need to have a valid administrator account on an affected device. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerabil
n affected device. The vulnerability is due to incorrect privilege assignment. An attacker could exploit this vulnerability by logging in to the system with a crafted Active Directory account. A successful exploit could allow the attacker to obtain root privileges on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-fNZX8hHj
CVE ID: CVE-2020-27123 State: PUBLISHED Published: 2020-11-06T18:15:47.548752Z Last Updated: 2024-11-13T17:44:26.944Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco AnyConnect Secure Mobility Client Problem Types: CWE-749 Description: A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to read arbitrary files on the underlying operating system of an affected device. The vulnerability is due to an exposed IPC function. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an
function. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process on an affected device. A successful exploit could allow the attacker to read arbitrary files on the underlying operating system of the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-anyconnect-file-read-LsvDD6Uh
CVE ID: CVE-2020-27124 State: PUBLISHED Published: 2024-11-18T16:03:00.333Z Last Updated: 2024-11-18T16:25:39.424Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/RL:X/RC:X/E:X) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-457 Description: A vulnerability in the SSL/TLS handler of Cisco&nbsp;Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause the affected device to reload unexpectedly, leading to a denial of service (DoS) condition. The vulnerability is due to improper error handling on established SSL/TLS connections. An attacker could exploit this vulnerability by establish
to improper error handling on established SSL/TLS connections. An attacker could exploit this vulnerability by establishing an SSL/TLS connection with the affected device and then sending a malicious SSL/TLS message within that connection. A successful exploit could allow the attacker to cause the device to reload.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-dos-7uZWwSEy - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory
tyAdvisory/cisco-sa-asa-ssl-dos-7uZWwSEy - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sa-rv-routers-xss-K7Z5U6q3 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-bLZw4Ctq
CVE ID: CVE-2020-27125 State: PUBLISHED Published: 2020-11-17T03:10:16.608738Z Last Updated: 2024-11-13T17:40:45.350Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Security Manager Problem Types: CWE-20 Description: A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability is due to insufficient protection of static credentials in the affected software. An attacker could exploit this vulnerability by viewing source code. A successful exploit could allow the attacker to view static credentials, which the attacker could use to carry ou
code. A successful exploit could allow the attacker to view static credentials, which the attacker could use to carry out further attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-rce-8gjUz9fW
CVE ID: CVE-2020-27126 State: PUBLISHED Published: 2020-11-18T17:40:55.339597Z Last Updated: 2024-11-13T17:38:43.213Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Webex Meetings Problem Types: CWE-80 Description: A vulnerability in an API of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper validation of user-supplied input to an application programmatic interface (API) within Cisco Webex Meetings. An attacker could exploit this vulnerability by convincing a targeted user to follow a link designed to submit malicious input to the API used
oit this vulnerability by convincing a targeted user to follow a link designed to submit malicious input to the API used by Cisco Webex Meetings. A successful exploit could allow the attacker to conduct cross-site scripting attacks and potentially gain access to sensitive browser-based information from the system of a targeted user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-meetings-xss-MX56prER
CVE ID: CVE-2020-27127 State: PUBLISHED Published: 2020-12-11T16:40:17.034468Z Last Updated: 2024-11-13T17:37:04.326Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Jabber Problem Types: CWE-201 Description: Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
CVE ID: CVE-2020-27128 State: PUBLISHED Published: 2020-11-06T18:15:52.734247Z Last Updated: 2024-11-13T17:44:16.670Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Cisco Products: Cisco SD-WAN vManage Problem Types: CWE-22 Description: A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. The vulnerability is due to improper validation of requests to APIs. An attacker could exploit this vulnerability by sending malicious requests to an API within the affected application. A successful exploit could allow the attacker to conduct directo
ous requests to an API within the affected application. A successful exploit could allow the attacker to conduct directory traversal attacks and write files to an arbitrary location on the targeted system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-file-Y2JSRNRb
CVE ID: CVE-2020-27129 State: PUBLISHED Published: 2020-11-06T18:15:58.758482Z Last Updated: 2024-11-13T17:44:07.665Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco SD-WAN vManage Problem Types: CWE-88 Description: A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the affected application. An attacker could exploit this vulnerability by sending malicious requests to the affected application. A succes
cation. An attacker could exploit this vulnerability by sending malicious requests to the affected application. A successful exploit could allow the attacker to inject arbitrary commands and potentially gain elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-privilege-zPmMf73k
CVE ID: CVE-2020-27130 State: PUBLISHED Published: 2020-11-17T03:10:26.483849Z Last Updated: 2024-11-13T17:40:24.850Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Security Manager Problem Types: CWE-35 Description: A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to an affected device. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to download arbitra
y by sending a crafted request to the affected device. A successful exploit could allow the attacker to download arbitrary files from the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-path-trav-NgeRnqgR
CVE ID: CVE-2020-27131 State: PUBLISHED Published: 2020-11-17T03:10:21.197314Z Last Updated: 2024-11-13T17:40:34.185Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Security Manager Problem Types: CWE-20 Description: Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a specific listener
e. An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of NT AUTHORITY\SYSTEM on the Windows target host. Cisco has not released software updates that address these vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-csm-java-rce-mWJEedcD
CVE ID: CVE-2020-27132 State: PUBLISHED Published: 2020-12-11T16:40:21.707428Z Last Updated: 2024-11-13T17:36:53.878Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Jabber Problem Types: CWE-201 Description: Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
CVE ID: CVE-2020-27133 State: PUBLISHED Published: 2020-12-11T16:40:26.283081Z Last Updated: 2024-11-13T17:36:43.302Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Jabber Problem Types: CWE-201 Description: Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
CVE ID: CVE-2020-27134 State: PUBLISHED Published: 2020-12-11T16:40:30.907621Z Last Updated: 2024-11-13T17:36:34.700Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Jabber Problem Types: CWE-201 Description: Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
CVE ID: CVE-2020-27146 State: PUBLISHED Published: 2020-11-10T17:50:12.620460Z Last Updated: 2024-09-17T04:08:46.251Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: TIBCO Software Inc. Products: TIBCO iProcess Workspace (Browser) Problem Types: Successful execution of this vulnerability can result in unauthorized read, update, insert or delete access to some of the data in the affected system. Description: The Core component of TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser) contains a vulnerability that theoretically allows an unauthenticated attacker with network access to execute a Cross Site Request Forgery (CSRF) attack on the affected system. A
thenticated attacker with network access to execute a Cross Site Request Forgery (CSRF) attack on the affected system. A successful attack using this vulnerability requires human interaction from an authenticated user other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO iProcess Workspace (Browser): versions 11.6.0 and below. Additional Analyst Notes: - CVE Program Container: References: - http://www.tibco.com/services/support/advisories - https://www.tibco.com/support/advisories/2020/11/tibco-security-advisory-november-10-2020-tibco-iprocess-workspace
CVE ID: CVE-2020-27147 State: PUBLISHED Published: 2020-12-15T17:55:12.153286Z Last Updated: 2024-09-16T19:40:52.297Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: TIBCO Software Inc. Products: TIBCO PartnerExpress Problem Types: Successful execution of this vulnerability can result in unauthorized read access to a subset of PartnerExpress data, as well as unauthorized update, insert or delete access to a subset of PartnerExpress data on the affected system. Description: The REST API component of TIBCO Software Inc.'s TIBCO PartnerExpress contains a vulnerability that theoretically allows an unauthenticated attacker with network access to obtain an authent