Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-15997 State: PUBLISHED Published: 2019-11-26T03:41:38.520943Z Last Updated: 2024-11-20T17:04:14.513Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco DNA Spaces Problem Types: CWE-20 Description: A vulnerability in Cisco DNA Spaces: Connector could allow an authenticated, local attacker to perform a command injection attack and execute arbitrary commands on the underlying operating system as root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command. An attacker could exploit this vulnerability by including malicious input during the execution of the affected command. A succes
ker could exploit this vulnerability by including malicious input during the execution of the affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-cmd-injection
CVE ID: CVE-2019-15998 State: PUBLISHED Published: 2019-11-26T03:41:32.678014Z Last Updated: 2024-11-19T18:51:44.429Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Cisco Products: Cisco IOS XR Software Problem Types: CWE-284 Description: A vulnerability in the access-control logic of the NETCONF over Secure Shell (SSH) of Cisco IOS XR Software may allow connections despite an access control list (ACL) that is configured to deny access to the NETCONF over SSH of an affected device. The vulnerability is due to a missing check in the NETCONF over SSH access control list (ACL). An attacker could exploit this vulnerability by connecting to an affected device us
over SSH access control list (ACL). An attacker could exploit this vulnerability by connecting to an affected device using NETCONF over SSH. A successful exploit could allow the attacker to connect to the device on the NETCONF port. Valid credentials are required to access the device. This vulnerability does not affect connections to the default SSH process on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-iosxr-ssh-bypass
CVE ID: CVE-2019-15999 State: PUBLISHED Published: 2020-01-06T07:45:16.625398Z Last Updated: 2024-11-15T17:52:40.426Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Data Center Network Manager Problem Types: CWE-284 Description: A vulnerability in the application environment of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to gain unauthorized access to the JBoss Enterprise Application Platform (JBoss EAP) on an affected device. The vulnerability is due to an incorrect configuration of the authentication settings on the JBoss EAP. An attacker could exploit this vulnerability by authenticating wi
ation of the authentication settings on the JBoss EAP. An attacker could exploit this vulnerability by authenticating with a specific low-privilege account. A successful exploit could allow the attacker to gain unauthorized access to the JBoss EAP, which should be limited to internal system accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-unauth-access - http://packetstormsecurity.com/files/155870/Cisco-DCNM-JBoss-10.4-Credential-Leakage.html
CVE ID: CVE-2019-16000 State: PUBLISHED Published: 2020-09-23T00:26:55.488486Z Last Updated: 2024-11-13T18:03:43.917Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: Cisco Products: Cisco Umbrella Enterprise Roaming Client for Windows Problem Types: CWE-345 Description: A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows file sys
Installer. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows file system. A successful exploit could allow the attacker to bypass configured policy and install unapproved applications. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-umbrella-msi-install
CVE ID: CVE-2019-16001 State: PUBLISHED Published: 2019-11-26T03:41:26.437971Z Last Updated: 2024-11-21T19:05:00.228Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Cisco Products: Cisco Webex Teams Problem Types: CWE-427 Description: A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit thi
is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the vulnerable application is launched. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user account. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-webex-teams-dll
CVE ID: CVE-2019-16002 State: PUBLISHED Published: 2019-11-26T03:41:20.291624Z Last Updated: 2024-11-21T19:05:12.045Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Cisco Products: Cisco vManage Software Problem Types: CWE-352 Description: A vulnerability in the vManage web-based UI (web UI) of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected instance of vManage. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful ex
f vManage. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-vman-csrf
CVE ID: CVE-2019-16003 State: PUBLISHED Published: 2020-01-26T04:45:40.135464Z Last Updated: 2024-11-15T17:43:58.260Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Cisco Products: Cisco UCS Director Problem Types: CWE-306 Description: A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to download system log files from an affected device. The vulnerability is due to an issue in the authentication logic of the web-based management interface. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to do
his vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to download log files if they were previously generated by an administrator. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ucs-dir-infodis
CVE ID: CVE-2019-16004 State: PUBLISHED Published: 2020-09-23T00:26:50.919329Z Last Updated: 2024-11-13T18:03:52.835Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Vision Dynamic Signage Director Problem Types: CWE-306 Description: A vulnerability in the REST API endpoint of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected device. The vulnerability is due to missing authentication on some of the API calls. An attacker could exploit this vulnerability by sending a request to one of the affected calls. A successful exploit could allow the attacker to interact w
erability by sending a request to one of the affected calls. A successful exploit could allow the attacker to interact with some parts of the API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-vdsd-auth-bypass
CVE ID: CVE-2019-16005 State: PUBLISHED Published: 2020-01-26T04:45:35.487445Z Last Updated: 2024-11-15T17:44:08.037Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Webex Video Mesh Problem Types: CWE-77 Description: A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated, remote attacker to execute arbitrary commands on the affected system. The vulnerability is due to improper validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrat
tware. An attacker could exploit this vulnerability by logging in to the web-based management interface with administrative privileges and supplying crafted requests to the application. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with root privileges on a targeted node. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-webex-video
CVE ID: CVE-2019-16007 State: PUBLISHED Published: 2020-09-23T00:26:45.174098Z Last Updated: 2024-11-13T18:04:01.991Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) Vendors: Cisco Products: Cisco AnyConnect Secure Mobility Client Problem Types: CWE-345 Description: A vulnerability in the inter-service communication of Cisco AnyConnect Secure Mobility Client for Android could allow an unauthenticated, local attacker to perform a service hijack attack on an affected device or cause a denial of service (DoS) condition. The vulnerability is due to the use of implicit service invocations. An attacker could exploit this vulnerability by persuading a user to install a mali
use of implicit service invocations. An attacker could exploit this vulnerability by persuading a user to install a malicious application. A successful exploit could allow the attacker to access confidential user information or cause a DoS condition on the AnyConnect application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-anyconnect-hijack
CVE ID: CVE-2019-16008 State: PUBLISHED Published: 2020-01-26T04:45:30.615870Z Last Updated: 2024-11-15T17:44:17.675Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco IP Phone 7800 Series with Multiplatform Firmware Problem Types: CWE-79 Description: A vulnerability in the web-based GUI of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based GUI of an affected system. An att
ulnerability is due to insufficient validation of user-supplied input by the web-based GUI of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-iphone-xss
CVE ID: CVE-2019-16009 State: PUBLISHED Published: 2020-09-23T00:26:40.485378Z Last Updated: 2024-11-13T18:04:10.953Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco IOS 12.2(15)B Problem Types: CWE-352 Description: A vulnerability in the web UI of Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections for the web UI on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could al
ploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the targeted user. If the user has administrative privileges, the attacker could alter the configuration, execute commands, or reload an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-ios-csrf
CVE ID: CVE-2019-16010 State: PUBLISHED Published: 2020-03-19T15:35:33.014377Z Last Updated: 2024-11-15T17:32:45.849Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco vManage Software Problem Types: CWE-79 Description: A vulnerability in the web UI of the Cisco SD-WAN vManage software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the vManage software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the i
input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200318-vmanage-xss
CVE ID: CVE-2019-16011 State: PUBLISHED Published: 2020-04-29T20:40:11.753483Z Last Updated: 2024-11-15T17:28:22.200Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco IOS XE SD-WAN Software Problem Types: CWE-77 Description: A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A
device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xesdwcinj-AcQ5MxCn
CVE ID: CVE-2019-16012 State: PUBLISHED Published: 2020-03-19T15:35:27.699415Z Last Updated: 2024-11-15T17:33:02.770Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco vManage Software Problem Types: CWE-77 Description: A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the
icating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200318-vmanage-cypher-inject
CVE ID: CVE-2019-16015 State: PUBLISHED Published: 2020-01-26T04:40:20.536649Z Last Updated: 2024-11-15T17:44:56.895Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Data Center Analytics Framework Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of the Cisco Data Center Analytics Framework application could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. A
due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information on the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-dcaf-xss
CVE ID: CVE-2019-16017 State: PUBLISHED Published: 2020-09-23T00:26:36.009383Z Last Updated: 2024-11-13T18:04:19.650Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Unified Customer Voice Portal (CVP) Problem Types: CWE-264 Description: A vulnerability in the Operations, Administration, Maintenance and Provisioning (OAMP) OpsConsole Server for Cisco Unified Customer Voice Portal (CVP) could allow an authenticated, remote attacker to execute Insecure Direct Object Reference actions on specific pages within the OAMP application. The vulnerability is due to insufficient input validation on specific pages of the OAMP application. An attack
lication. The vulnerability is due to insufficient input validation on specific pages of the OAMP application. An attacker could exploit this vulnerability by authenticating to Cisco Unified CVP and sending crafted HTTP requests. A successful exploit could allow an attacker with administrator or read-only privileges to learn information outside of their expected scope. An attacker with administrator privileges could modify certain configuration details of resources outside of their defined scope, which could result in a denial of service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/C
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200108-cvp-direct-obj-ref
CVE ID: CVE-2019-16018 State: PUBLISHED Published: 2020-01-26T04:30:48.072294Z Last Updated: 2024-11-15T17:46:42.156Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco IOS XR Software Problem Types: CWE-399 Description: A vulnerability in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of a BGP update message that contains crafted EVPN attributes. An attacker could indirectly exploit the vulnerability by sending BGP EVPN update messages w
ns crafted EVPN attributes. An attacker could indirectly exploit the vulnerability by sending BGP EVPN update messages with a specific, malformed attribute to an affected system and waiting for a user on the device to display the EVPN operational routes&rsquo; status. If successful, the attacker could cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit this vulnerability, the malicious BGP update message would need to come from a configured, valid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP conn
alid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP connection to a BGP peer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-routes
CVE ID: CVE-2019-16019 State: PUBLISHED Published: 2020-09-23T00:26:31.511247Z Last Updated: 2024-11-13T18:04:28.358Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco IOS XR Software Problem Types: CWE-399 Description: Multiple vulnerabilities in the implementation of Border Gateway Protocol (BGP) Ethernet VPN (EVPN) functionality in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerabilities are due to incorrect processing of BGP update messages that contain crafted EVPN attributes. An attacker could exploit these vulnerabilities by sending BGP EVPN update message
that contain crafted EVPN attributes. An attacker could exploit these vulnerabilities by sending BGP EVPN update messages with malformed attributes to be processed by an affected system. A successful exploit could allow the attacker to cause the BGP process to restart unexpectedly, resulting in a DoS condition. The Cisco implementation of BGP accepts incoming BGP traffic only from explicitly defined peers. To exploit these vulnerabilities, the malicious BGP update message would need to come from a configured, valid BGP peer, or would need to be injected by the attacker into the victim's BGP network on an existing, valid TCP connection to a BGP peer. Additional Analyst Notes: - CVE Program Co
the victim's BGP network on an existing, valid TCP connection to a BGP peer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-ios-xr-evpn