Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-9064 State: PUBLISHED Published: 2018-07-30T15:00:00Z Last Updated: 2024-09-16T19:04:25.593Z Vendors: Lenovo Group Ltd. Products: Lenovo xClarity Administrator Problem Types: Privilege escalation Description: In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user may abuse a web API debug call to retrieve the credentials for the System Manager user. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-22168
CVE ID: CVE-2018-9065 State: PUBLISHED Published: 2018-07-30T15:00:00Z Last Updated: 2024-09-16T17:28:39.870Z Vendors: Lenovo Group Ltd. Products: Lenovo xClarity Administrator Problem Types: Privilege escalation Description: In Lenovo xClarity Administrator versions earlier than 2.1.0, an attacker that gains access to the underlying LXCA file system user may be able to retrieve a credential store containing the service processor user names and passwords for servers previously managed by that LXCA instance, and potentially decrypt those credentials more easily than intended. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-22168
CVE ID: CVE-2018-9066 State: PUBLISHED Published: 2018-07-30T15:00:00Z Last Updated: 2024-09-16T17:14:32.440Z Vendors: Lenovo Group Ltd. Products: Lenovo xClarity Administrator Problem Types: Privilege escalation Description: In Lenovo xClarity Administrator versions earlier than 2.1.0, an authenticated LXCA user can, under specific circumstances, inject additional parameters into a specific web API call which can result in privileged command execution within LXCA's underlying operating system. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-22168
CVE ID: CVE-2018-9067 State: PUBLISHED Published: 2018-07-13T16:00:00Z Last Updated: 2024-09-17T02:07:16.584Z Vendors: Lenovo Group Ltd. Products: Lenovo Help Android application Problem Types: Exposure and modification of private app data Description: The Lenovo Help Android app versions earlier than 6.1.2.0327 had insufficient access control for some functions which, if exploited, could have led to exposure of approximately 400 email addresses and 8,500 IMEI. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-21561
CVE ID: CVE-2018-9068 State: PUBLISHED Published: 2018-07-26T19:00:00Z Last Updated: 2024-09-17T03:38:52.294Z Vendors: Lenovo Group Ltd., IBM Corporation Products: System x IMM2 Problem Types: Information disclosure Description: The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker wit
e credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-20227
CVE ID: CVE-2018-9069 State: PUBLISHED Published: 2018-10-02T14:00:00 Last Updated: 2024-08-05T07:17:50.652Z Vendors: Lenovo Group LTD Products: IdeaPad Problem Types: Privilege escalation Description: In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-20184
CVE ID: CVE-2018-9070 State: PUBLISHED Published: 2018-07-13T16:00:00Z Last Updated: 2024-09-16T19:09:48.146Z Vendors: Lenovo Group Ltd. Products: Lenovo Smart Assistant Problem Types: Root access of the device Description: For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by pressing a specific button sequence, enter factory test mode and enable a web service intended for testing the device. As with most test modes, this provides extra privileges, including changing settings and running code. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo. Additional Analyst Notes: - CVE P
. Lenovo Smart Assistant is an Amazon Alexa-enabled smart speaker developed by Lenovo. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-22172
CVE ID: CVE-2018-9071 State: PUBLISHED Published: 2018-11-16T14:00:00 Last Updated: 2024-08-05T07:17:50.339Z Vendors: Lenovo Products: Chassis Management Module (CMM) Problem Types: Information Disclosure Description: Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-23806
CVE ID: CVE-2018-9072 State: PUBLISHED Published: 2018-11-30T14:00:00 Last Updated: 2024-08-05T07:17:50.638Z Vendors: Lenovo Products: LXCI for VMware Problem Types: Privilege escalation Description: In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-23800
CVE ID: CVE-2018-9073 State: PUBLISHED Published: 2018-11-16T14:00:00 Last Updated: 2024-08-05T07:17:50.603Z Vendors: Lenovo Products: Chassis Management Module (CMM) Problem Types: Hardcoded Encryption Key Description: Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-23806
CVE ID: CVE-2018-9074 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.355Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Path traversal Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9075 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.367Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Arbitrary Command Execution Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the client:password parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.
value __c and iomega parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9076 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.595Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Arbitrary Command Execution Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/so
d iomega parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9077 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.598Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Arbitrary Command Execution Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft a command injection payload using backtick "``" characters in the share : name parameter. As a result, arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/
e __c and iomega parameter. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9078 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.689Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: SVG Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the ability to upload files to shares and this image was rendered in the browser in the device's origin instead of prompting to download the asset. The application does not prevent the user from uploading SVG images and returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary J
nd returns these images within their origin. As a result, malicious users can upload SVG images that contain arbitrary JavaScript that is evaluated when the victim issues a request to download the file. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9079 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.623Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Arbitrary code execution Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object Model (DOM) of the page. In addition, adversaries can inject HTML script tags and HTML tags with JavaScript handlers to execute arbitrary JavaScript with the origin of the device. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9080 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.641Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Session fixation Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before logging into the NAS's web application, the NAS will not provide the user a new cookie value. This allows an attacker who knows the cookie's value to compromise the user's session. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9081 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.658Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Cross-site scripting (XSS) Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Content Viewer application are vulnerable to self cross-site scripting self-XSS. As a result, adversaries can add files to shares accessible from the Content Viewer with a cross site scripting payload in its name, and wait for a user to try and rename the file for their payload to trigger. Additional Analy
pting payload in its name, and wait for a user to try and rename the file for their payload to trigger. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9082 State: PUBLISHED Published: 2018-09-28T20:00:00 Last Updated: 2024-08-05T07:17:50.627Z Vendors: Lenovo Group LTD Products: Iomega StorCenter, LenovoEMC, EZ Media and Backup Center Problem Types: Password change does not require existing password Description: For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authenticated users does not require the user's current password to set a new one. As a result, attackers with access to the user's session tokens can change their password and retain access to the user's account Additional Analyst Notes: - CVE Program Container: References: - https://s
sword and retain access to the user's account Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24224
CVE ID: CVE-2018-9083 State: PUBLISHED Published: 2018-11-27T14:00:00 Last Updated: 2024-08-05T07:17:50.616Z Vendors: Lenovo Products: ThinkSystem SMM Problem Types: Privilege escalation Description: In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24374
CVE ID: CVE-2018-9084 State: PUBLISHED Published: 2018-11-27T14:00:00 Last Updated: 2024-08-05T07:17:50.623Z Vendors: Lenovo Products: ThinkSystem SMM Problem Types: Privilege escalation Description: In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24374
CVE ID: CVE-2018-9085 State: PUBLISHED Published: 2018-11-16T14:00:00 Last Updated: 2024-08-05T07:17:50.596Z Vendors: Lenovo, IBM Products: System x UEFI Problem Types: Denial of service Description: A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-24477
CVE ID: CVE-2018-9086 State: PUBLISHED Published: 2018-11-16T14:00:00 Last Updated: 2024-08-05T07:17:51.040Z Vendors: Lenovo Products: ThinkServer BMC Problem Types: Arbitrary Code Execution Description: In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/solutions/LEN-23836
CVE ID: CVE-2018-9090 State: PUBLISHED Published: 2019-09-24T13:38:56 Last Updated: 2024-08-05T07:17:50.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards. Additional Analyst Notes: - CVE Program Container: References: - https://coreos.com/tectonic/releases/ - https://coreos.com/tectonic/releases/#1.8.
CVE Program Container: References: - https://coreos.com/tectonic/releases/ - https://coreos.com/tectonic/releases/#1.8.7-tectonic.2
CVE ID: CVE-2018-9091 State: PUBLISHED Published: 2018-05-25T19:00:00 Last Updated: 2024-08-05T07:17:50.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: A critical vulnerability in the KEMP LoadMaster Operating System (LMOS) 6.0.44 through 7.2.41.2 and Long Term Support (LTS) LMOS before 7.1.35.5 related to Session Management could allow an unauthenticated, remote attacker to bypass security protections, gain system privileges, and execute elevated commands such as ls, ps, cat, etc., thereby compromising the system. Through this remote execution, in certain cases, exposure of sensitive system data such as certificates, private keys, and other information may be possible. Addit
ases, exposure of sensitive system data such as certificates, private keys, and other information may be possible. Additional Analyst Notes: - CVE Program Container: References: - https://support.kemptechnologies.com/hc/en-us/articles/360001982452-Mitigation-for-Remote-Access-Execution-Vulnerability
CVE ID: CVE-2018-9092 State: PUBLISHED Published: 2018-03-27T22:00:00 Last Updated: 2024-08-05T07:17:50.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/14 - https://www.exploit-db.com/exploits/44362/
CVE ID: CVE-2018-9101 State: PUBLISHED Published: 2018-04-25T20:00:00 Last Updated: 2024-08-05T07:17:50.696Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launch_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security
y scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security-advisory-18-0003 - https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf
CVE ID: CVE-2018-9102 State: PUBLISHED Published: 2018-04-25T20:00:00 Last Updated: 2024-08-05T07:17:50.744Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allow an attacker to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security-ad
tabase. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security-advisory-18-0003 - https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf
CVE ID: CVE-2018-9103 State: PUBLISHED Published: 2018-04-25T20:00:00 Last Updated: 2024-08-05T07:17:51.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security-advisory-
Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security-advisory-18-0003 - https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf
CVE ID: CVE-2018-9104 State: PUBLISHED Published: 2018-04-25T20:00:00 Last Updated: 2024-08-05T07:17:51.129Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploit could allow an attacker to execute arbitrary scripts. Additional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security-advisory-18-
ditional Analyst Notes: - CVE Program Container: References: - https://www.mitel.com/mitel-product-security-advisory-18-0003 - https://www.mitel.com/sites/default/files/2018-Security-Bulletin-18-0003-001.pdf
CVE ID: CVE-2018-9105 State: PUBLISHED Published: 2018-03-27T23:00:00Z Last Updated: 2024-09-16T17:48:23.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately this XPC service is not protected, which allows arbitrary applications to connect and send it XPC messages. An attacker can send a crafted XPC message to the privileged helper tool requesting it make a new OpenVPN connection. Because
tacker can send a crafted XPC message to the privileged helper tool requesting it make a new OpenVPN connection. Because he or she controls the contents of the XPC message, the attacker can specify the location of the openvpn executable, which could point to something malicious they control located on disk. Without validation of the openvpn executable, this will give the attacker code execution in the context of the privileged helper tool. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2018-015.md
CVE ID: CVE-2018-9106 State: PUBLISHED Published: 2018-03-28T04:00:00 Last Updated: 2024-08-05T07:17:50.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44370/ - https://www.acyba.com/acysms/change-log.html