Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-g8AOKnDP - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-xss-M446vbEO - https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75300
CVE ID: CVE-2024-20276 State: PUBLISHED Published: 2024-03-27T16:51:46.937Z Last Updated: 2024-08-01T21:52:31.696Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: IOS Problem Types: CWE-248 Description: A vulnerability in Cisco IOS Software for Cisco Catalyst 6000 Series Switches could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly. This vulnerability is due to improper handling of process-switched traffic. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in
o an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-dos-Hq4d3tZG
CVE ID: CVE-2024-20277 State: PUBLISHED Published: 2024-01-17T16:58:21.065Z Last Updated: 2024-10-23T18:47:10.421Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco ThousandEyes Recorder Application Problem Types: CWE-78 Description: A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP pa
of user-supplied input for the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP packet to the affected device. A successful exploit could allow the attacker to execute arbitrary commands and elevate privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-thouseyes-privesc-DmzHG3Qv
CVE ID: CVE-2024-20278 State: PUBLISHED Published: 2024-03-27T16:59:12.963Z Last Updated: 2024-08-15T16:45:09.481Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-184 Description: A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevate privileges to root on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input over NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator
r NETCONF to an affected device. A successful exploit could allow the attacker to elevate privileges from Administrator to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-priv-esc-seAx6NLX
CVE ID: CVE-2024-20279 State: PUBLISHED Published: 2024-08-28T16:19:08.343Z Last Updated: 2024-08-28T17:54:51.419Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Application Policy Infrastructure Controller (APIC) Problem Types: CWE-284 Description: A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an authenticated, remote attacker to modify the behavior of default system policies, such as quality of service (QoS) policies, on an affected system.&nbsp;This vulnerability is due to improper access control when restricted security domains are used to i
ffected system.&nbsp;This vulnerability is due to improper access control when restricted security domains are used to implement multi-tenancy. An attacker with a valid user account associated with a restricted security domain could exploit this vulnerability. A successful exploit could allow the attacker to read, modify, or delete child policies created under default system policies, which are implicitly used by all tenants in the fabric, resulting in disruption of network traffic. Exploitation is not possible for policies under tenants that an attacker has no authorization to access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/c
n to access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-cousmo-uBpBYGbq
CVE ID: CVE-2024-20280 State: PUBLISHED Published: 2024-10-16T16:15:37.008Z Last Updated: 2024-10-31T14:13:19.791Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) Vendors: Cisco Products: Cisco Unified Computing System Central Software Problem Types: CWE-321 Description: A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leverag
hat is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leveraging a static key that is used for the backup configuration feature. A successful exploit could allow an attacker with access to a backup file to learn sensitive information that is stored in full state backup files and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsc-bkpsk
ichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsc-bkpsky-TgJ5f73J
CVE ID: CVE-2024-20281 State: PUBLISHED Published: 2024-04-03T16:20:04.470Z Last Updated: 2024-08-01T21:59:41.178Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Data Center Network Manager, Cisco Nexus Dashboard, Cisco Nexus Dashboard Orchestrator, Cisco Nexus Dashboard Insights Problem Types: CWE-352 Description: A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based manag
(CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface on an affected system. An attacker could exploit this vulnerability by persuading a user to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user. If the affected user has administrative privileges, these actions could include modifying the system configuration and creating new privileged accounts. Note: There are internal security mechanisms in place that limit the scope of this exploit, reducing the Security Impact Rating of this vulnerability. Additional Analyst Not
that limit the scope of this exploit, reducing the Security Impact Rating of this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndfccsrf-TEmZEfJ9
CVE ID: CVE-2024-20282 State: PUBLISHED Published: 2024-04-03T16:20:33.850Z Last Updated: 2024-08-27T13:39:11.505Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Nexus Dashboard Problem Types: CWE-269 Description: A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileges to root on an affected device. This vulnerability is due to insufficient protections for a sensitive access token. An attacker could exploit this vulnerability by using this token to access resources within the device infrastructure. A successful exploit could allow an attacker to gain r
this token to access resources within the device infrastructure. A successful exploit could allow an attacker to gain root access to the filesystem or hosted containers on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndru-pesc-kZ2PQLZH
CVE ID: CVE-2024-20283 State: PUBLISHED Published: 2024-04-03T16:25:09.906Z Last Updated: 2024-08-01T21:59:41.127Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Cisco Products: Cisco Nexus Dashboard Problem Types: CWE-284 Description: A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affected device. This vulnerability is due to improper access controls on a specific API endpoint. An attacker could exploit this vulnerability by sending queries to the API endpoint. A successful exploit could allow an attacker to access metrics and information about devices in the Nexus Dashbo
dpoint. A successful exploit could allow an attacker to access metrics and information about devices in the Nexus Dashboard cluster. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndidv-LmXdvAf2
CVE ID: CVE-2024-20284 State: PUBLISHED Published: 2024-08-28T16:37:35.281Z Last Updated: 2024-08-28T17:19:17.361Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-693 Description: A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A succes
An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A successful exploit could allow an attacker to escape the Python sandbox and execute arbitrary commands on the underlying operating system with the privileges of the authenticated user.&nbsp; Note: An attacker must be authenticated with Python execution privileges to exploit these vulnerabilities. For more information regarding Python execution privileges, see product-specific documentation, such as the section of the Cisco Nexus 9000 Series NX-OS Programmability Guide. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center
Guide. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-psbe-ce-YvbTn5du - https://www.cisco.com/c/en/us/td/docs/dcn/nx-os/nexus9000/105x/programmability/cisco-nexus-9000-series-nx-os-programmability-guide-105x/m-n9k-python-api-101x.html?bookSearch=true#concept_A2CFF094ADCB414C983EA06AD8E9A410
CVE ID: CVE-2024-20285 State: PUBLISHED Published: 2024-08-28T16:37:27.149Z Last Updated: 2024-08-28T17:19:57.207Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-653 Description: A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A succes
CVE ID: CVE-2024-20286 State: PUBLISHED Published: 2024-08-28T16:37:17.319Z Last Updated: 2024-08-28T17:23:56.426Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-693 Description: A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by manipulating specific functions within the Python interpreter. A succes
CVE ID: CVE-2024-20287 State: PUBLISHED Published: 2024-01-17T16:58:01.192Z Last Updated: 2025-06-02T15:05:08.192Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Business Wireless Access Point Software Problem Types: CWE-88 Description: A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to
per validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web-based management interface of an affected system. A successful exploit could allow the attacker to execute arbitrary commands with root privileges on the device. To exploit this vulnerability, the attacker must have valid administrative credentials for the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-wap-inject-bHStWgXO
CVE ID: CVE-2024-20289 State: PUBLISHED Published: 2024-08-28T16:31:23.856Z Last Updated: 2024-08-28T17:24:18.101Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco NX-OS Software, Cisco NX-OS System Software in ACI Mode Problem Types: CWE-78 Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to execute arbitrary commands on the underlying operating system of an affected device.&nbsp; This vulnerability is due to insufficient validation of arguments for a specific CLI command. An attacker could exploit this vulnerability by including crafted input as the argument of
s for a specific CLI command. An attacker could exploit this vulnerability by including crafted input as the argument of the affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the currently logged-in user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cmdinj-Lq6jsZhH
CVE ID: CVE-2024-20290 State: PUBLISHED Published: 2024-02-07T16:16:00.975Z Last Updated: 2025-02-13T17:32:30.128Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Secure Endpoint, Cisco Secure Endpoint Private Cloud Administration Portal, Cisco Secure Endpoint Private Cloud Console Problem Types: CWE-126 Description: A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could e
correct check for end-of-string values during scanning, which may result in a heap buffer over-read. An attacker could exploit this vulnerability by submitting a crafted file containing OLE2 content to be scanned by ClamAV on an affected device. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software and consuming available system resources. For a description of this vulnerability, see the ClamAV blog . Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t - http
ferences: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-clamav-hDffu6t - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6MUDUPAHAAV6FPB2C2QIQCFJ4SHYBOTY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FXZYVDNV66RNMNVJOHAJAYRZV4U64CQ/
CVE ID: CVE-2024-20291 State: PUBLISHED Published: 2024-02-28T16:16:33.950Z Last Updated: 2024-08-09T14:58:23.652Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-284 Description: A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, remote attacker to send traffic that should be blocked through an affected device. This vulnerability is due to incorrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker cou
rrect hardware programming that occurs when configuration changes are made to port channel member ports. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access network resources that should be protected by an ACL that was applied on port channel subinterfaces. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-po-acl-TkyePgvL
CVE ID: CVE-2024-20292 State: PUBLISHED Published: 2024-03-06T16:32:55.529Z Last Updated: 2024-08-01T21:59:41.112Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco Duo Problem Types: CWE-200 Description: A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. This vulnerability is due to improper storage of an unencrypted registry key in certain logs. An attacker could exploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the attacker to v
ploit this vulnerability by accessing the logs on an affected system. A successful exploit could allow the attacker to view sensitive information in clear text. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-duo-infodisc-rLCEqm6T
CVE ID: CVE-2024-20293 State: PUBLISHED Published: 2024-05-22T16:55:23.961Z Last Updated: 2024-08-01T21:59:41.290Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense Software Problem Types: CWE-436 Description: A vulnerability in the activation of an access control list (ACL) on Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the protection that is offered by a configured ACL on an affected device. This vulnerability is due to a logic error that occurs when a
that is offered by a configured ACL on an affected device. This vulnerability is due to a logic error that occurs when an ACL changes from inactive to active in the running configuration of an affected device. An attacker could exploit this vulnerability by sending traffic through the affected device that should be denied by the configured ACL. The reverse condition is also true—traffic that should be permitted could be denied by the configured ACL. A successful exploit could allow the attacker to bypass configured ACL protections on the affected device, allowing the attacker to access trusted networks that the device might be protecting. Note: This vulnerability applies to both IPv4 and IPv
er to access trusted networks that the device might be protecting. Note: This vulnerability applies to both IPv4 and IPv6 traffic as well as dual-stack ACL configurations in which both IPv4 and IPv6 ACLs are configured on an interface. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ogsnsg-aclbyp-3XB8q6jX
CVE ID: CVE-2024-20294 State: PUBLISHED Published: 2024-02-28T16:16:56.717Z Last Updated: 2024-08-01T21:59:41.160Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco NX-OS Software, Cisco Unified Computing System (Managed), Cisco Firepower Extensible Operating System (FXOS), Cisco NX-OS System Software in ACI Mode Problem Types: CWE-805 Description: A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of specific fi
a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of specific fields in an LLDP frame. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface of an affected device and having an authenticated user retrieve LLDP statistics from the affected device through CLI show commands or Simple Network Management Protocol (SNMP) requests. A successful exploit could allow the attacker to cause the LLDP service to crash and stop running on the affected device. In certain situations, the LLDP crash may result in a reload of the affected device. Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability,
sh may result in a reload of the affected device. Note: LLDP is a Layer 2 link protocol. To exploit this vulnerability, an attacker would need to be directly connected to an interface of an affected device, either physically or logically (for example, through a Layer 2 Tunnel configured to transport the LLDP protocol). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-lldp-dos-z7PncTgt