Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-3736 State: PUBLISHED Published: 2017-11-02T17:00:00Z Last Updated: 2024-09-16T20:12:39.274Z Vendors: OpenSSL Software Foundation Products: OpenSSL Problem Types: carry-propagating bug Description: There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amou
fficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. This only affects processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later or AMD Ryzen. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap
or AMD Ryzen. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20171107-0002/ - https://access.redhat.com/errata/RHSA-2018:2185 - https://github.com/openssl/openssl/commit/4443cf7aa0099e5ce615c18cee249fff77fb0871 - https://access.redhat.com/errata/RHSA-2018:2186 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://access.redhat.com/errata/RHSA-2018:2713 - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.debian.org/security/2017/dsa-4018 - https://security.gentoo.org/glsa/201712-03 -
y/cpujan2019-5072801.html - https://www.debian.org/security/2017/dsa-4018 - https://security.gentoo.org/glsa/201712-03 - https://access.redhat.com/errata/RHSA-2018:0998 - https://access.redhat.com/errata/RHSA-2018:2575 - https://www.tenable.com/security/tns-2017-15 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - http://www.securityfocus.com/bid/101666 - https://access.redhat.com/errata/RHSA-2018:2568 - https://www.openssl.org/news/secadv/20171102.txt - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.debian.org/security/2017/dsa-4017 - https://www.tenable.com/security/tns-2017-14 - https://security.FreeBSD.org/advisorie
ebian.org/security/2017/dsa-4017 - https://www.tenable.com/security/tns-2017-14 - https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc - http://www.securitytracker.com/id/1039727 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us - https://access.redhat.com/errata/RHSA-2018:2187 - https://security.netapp.com/advisory/ntap-20180117-0002/ - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE ID: CVE-2017-3737 State: PUBLISHED Published: 2017-12-07T16:00:00Z Last Updated: 2024-09-17T03:53:31.262Z Vendors: OpenSSL Software Foundation Products: OpenSSL Problem Types: Unauthenticated read/unencrypted write Description: OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called di
L_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. Ope
ed after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2185 - https://access.redhat.com/errata/RHSA-2018:2186 - https://github.com/openssl/openssl/commit/898fb884b706aaeb283de4812340bb0bde8476dc - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://security.netapp.com/advisory/ntap-20180419-0002/ - https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc - https://security
m/advisory/ntap-20180419-0002/ - https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc - https://security.gentoo.org/glsa/201712-03 - http://www.securitytracker.com/id/1039978 - https://www.openssl.org/news/secadv/20171207.txt - https://www.digitalmunition.me/2017/12/cve-2017-3737-openssl-security-bypass-vulnerability/ - https://access.redhat.com/errata/RHSA-2018:0998 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - https://www.debian.org/security/2017/dsa-4065 - https://cert-portal.siemens.com/productcert/pdf/ssa-179516.pdf - http://www.securityfocus.com/bid/102103 - https://www.tenable.com/security/tns-2017-16 - https://access.redhat.com/errata
ttp://www.securityfocus.com/bid/102103 - https://www.tenable.com/security/tns-2017-16 - https://access.redhat.com/errata/RHSA-2018:2187 - https://security.netapp.com/advisory/ntap-20180117-0002/ - https://security.netapp.com/advisory/ntap-20171208-0001/ - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE ID: CVE-2017-3738 State: PUBLISHED Published: 2017-12-07T16:00:00Z Last Updated: 2024-09-16T18:34:25.955Z Vendors: OpenSSL Software Foundation Products: OpenSSL Problem Types: carry-propagating bug Description: There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for s
ork necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of Ope
.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/tns-2018-07 - https://www.tenable.com/security/tns-2018-04 - https://access.redhat.com/errata/RHSA-2018:2185 - https://access.redhat.com/errata/RHSA-2018:2186 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.
work/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc - https://security.gentoo.org/glsa/201712-03 - http://www.securitytracker.com/id/1039978 - https://www.debian.org/security/2018/dsa-4157 - https://www.openssl.org/news/secadv/20171207.txt - https://access.redhat.com/errata/RHSA-2018:0998 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - https://github.com/openssl/openssl/commit/e502cc86df9dafded1694fceb3228ee34d11c11a - https://www.tenable.co
78067.html - https://github.com/openssl/openssl/commit/e502cc86df9dafded1694fceb3228ee34d11c11a - https://www.tenable.com/security/tns-2018-06 - https://www.debian.org/security/2017/dsa-4065 - https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://www.securityfocus.com/bid/102118 - https://www.tenable.com/security/tns-2017-16 - https://www.openssl.org/news/secadv/20180327.txt - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us - https://access.redhat.com/errata/RHSA-2018:2187 - https://security.netapp.com/advisory/ntap-20171208-0001/ - https:/
s - https://access.redhat.com/errata/RHSA-2018:2187 - https://security.netapp.com/advisory/ntap-20171208-0001/ - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
CVE ID: CVE-2017-3739 State: REJECTED Published: 2018-01-29T19:00:00 Last Updated: 2018-01-29T18:57:01 Description: No description available.
CVE ID: CVE-2017-3740 State: PUBLISHED Published: 2017-06-03T00:00:00 Last Updated: 2024-08-05T14:39:40.912Z Vendors: Lenovo Group Ltd. Products: Active Protection System Problem Types: Denial of Service Description: In Lenovo Active Protection System before 1.82.0.14, an attacker with local privileges could send commands to the system's embedded controller, which could cause a denial of service attack on the system or the ability to alter hardware functionality. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-13637
CVE ID: CVE-2017-3741 State: PUBLISHED Published: 2017-06-03T00:00:00 Last Updated: 2024-08-05T14:39:40.937Z Vendors: Lenovo Group Ltd. Products: Power Management Driver Problem Types: Alter trackpoint functionality Description: In the Lenovo Power Management driver before 1.67.12.24, a local user may alter the trackpoint's firmware and stop the trackpoint from functioning correctly. This issue only affects ThinkPad X1 Carbon 5th generation. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-14440
CVE ID: CVE-2017-3742 State: PUBLISHED Published: 2017-07-17T19:00:00Z Last Updated: 2024-09-16T19:51:52.104Z Vendors: Lenovo Group Ltd. Products: Lenovo Connect2 Problem Types: Disclosure of ad-hoc wifi network key stored in user-readable location Description: In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. An attacker with read access to the user's contents could connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two syste
uld connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two systems. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-14398
CVE ID: CVE-2017-3743 State: PUBLISHED Published: 2017-06-20T00:00:00 Last Updated: 2024-08-05T14:39:40.750Z Vendors: Lenovo Group Ltd. Products: ToolsCenter Problem Types: Sensitive information disclosure Description: If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing. Additional Analyst Notes: - CVE Program Container: References: - ht
d machine during the time the command is processing. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-10810
CVE ID: CVE-2017-3744 State: PUBLISHED Published: 2017-06-20T00:00:00 Last Updated: 2024-08-05T14:39:41.051Z Vendors: Lenovo Group Ltd. Products: Lenovo System x IMM2 Problem Types: Disclosure of login credentials to user with local privileges Description: In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands. Additional Analyst Notes: - CVE P
can capture and export FFDC service log data may have access to these remote commands. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/product_security/LEN-14054
CVE ID: CVE-2017-3745 State: PUBLISHED Published: 2017-06-20T00:00:00 Last Updated: 2024-08-05T14:39:41.321Z Vendors: Lenovo Group Ltd. Products: XClarity Administrator Problem Types: Disclosure of credentials to a non-administrative user Description: In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to password information for users that have previously authenticated to the LXCA's internal LDAP server, including administrative accounts and service accounts with administrative privileges. This is an issue only for users who have used local authentication with LXCA and not remote authentication against exte
This is an issue only for users who have used local authentication with LXCA and not remote authentication against external LDAP or ADFS servers. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-13671
CVE ID: CVE-2017-3746 State: PUBLISHED Published: 2017-08-28T20:00:00Z Last Updated: 2024-09-17T00:11:51.684Z Vendors: Lenovo Group Ltd. Products: ThinkPad USB 3.0 Ethernet Adapter Driver Problem Types: Privilege escalation Description: ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerability that could allow a local user to execute arbitrary code with administrative or system level privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-9896 - http://www.securityfocus.com/bid/100520
CVE ID: CVE-2017-3747 State: PUBLISHED Published: 2017-06-29T15:00:00Z Last Updated: 2024-09-16T22:56:01.952Z Vendors: Lenovo Group Ltd. Products: Lenovo Nerve Center Problem Types: Privilege escalation Description: Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not affected) that could allow an attacker with local privileges on a system to alter registry keys. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99286 - https://support.lenovo.com/us/en/product_security/LEN-15046
CVE ID: CVE-2017-3748 State: PUBLISHED Published: 2017-06-29T15:00:00Z Last Updated: 2024-09-16T18:55:20.530Z Vendors: Lenovo Group Ltd. Products: Lenovo Vibe and Lenovo China-only Moto Mobile Phones Problem Types: Privilege escalation Description: On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly known as 'rooting' or "jail breaking" a device). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99295 - https://support.lenovo.com/us/en/product_security/LEN-15823
CVE ID: CVE-2017-3749 State: PUBLISHED Published: 2017-06-29T15:00:00Z Last Updated: 2024-09-16T22:14:51.507Z Vendors: Lenovo Group Ltd. Products: Lenovo Vibe and Lenovo China-only Moto Mobile Phones Problem Types: Privilege escalation Description: On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-15823
CVE ID: CVE-2017-3750 State: PUBLISHED Published: 2017-06-29T15:00:00Z Last Updated: 2024-09-16T22:40:14.066Z Vendors: Lenovo Group Ltd. Products: Lenovo Vibe and Lenovo China-only Moto Mobile Phones Problem Types: Privilege escalation Description: On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3749. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-15823
CVE ID: CVE-2017-3751 State: PUBLISHED Published: 2017-08-10T00:00:00Z Last Updated: 2024-09-16T23:06:50.564Z Vendors: Lenovo Group Ltd. Products: ThinkPad Compact USB Keyboard with TrackPoint Driver Problem Types: Privilege Escalation Description: An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. This could allow an attacker with local privileges to execute code with administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-15061
CVE ID: CVE-2017-3752 State: PUBLISHED Published: 2017-08-09T21:00:00Z Last Updated: 2024-09-16T23:36:44.002Z Vendors: Lenovo Group Ltd. Products: Lenovo and IBM Switch Products Problem Types: Erasure or alteration of routing tables within a routing domain Description: An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may result in attackers being able to erase or alter the routing tables of one or many routers, switches, or other devices that support OSPF within a routing domain. Additional Analyst Notes: - CVE Program Container: References:
other devices that support OSPF within a routing domain. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-14078 - http://www.securityfocus.com/bid/99995
CVE ID: CVE-2017-3753 State: PUBLISHED Published: 2017-08-10T00:00:00Z Last Updated: 2024-09-16T20:47:47.220Z Vendors: Lenovo Group Ltd. Products: Desktop and Notebook BIOS Problem Types: Execution of code in System Management Mode by an attacker with local administrative access Description: A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V. Additional Analyst Notes: -
ted code that can allow them to bypass system protections such as Device Guard and Hyper-V. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-14695
CVE ID: CVE-2017-3754 State: PUBLISHED Published: 2017-07-17T19:00:00Z Last Updated: 2024-09-16T18:12:56.349Z Vendors: Lenovo Group Ltd. Products: Lenovo Notebook BIOS Problem Types: BIOS Write Protections Improperly Configured Description: Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-15084
CVE ID: CVE-2017-3755 State: REJECTED Published: N/A Last Updated: 2024-07-29T20:40:42.763Z Description: No description available.
CVE ID: CVE-2017-3756 State: PUBLISHED Published: 2017-08-18T19:00:00Z Last Updated: 2024-09-16T19:36:23.552Z Vendors: Lenovo Group Ltd. Products: ThinkPad Active Protection System Problem Types: Privilege Escalation Description: A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with local privileges could execute code with administrative privileges via an unquoted service path. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100305 - https://support.lenovo.com/us/en/product_security/LEN-15765
CVE ID: CVE-2017-3757 State: PUBLISHED Published: 2017-08-28T20:00:00Z Last Updated: 2024-09-16T23:36:32.422Z Vendors: Lenovo Group Ltd. Products: Lenovo ElanTech Touchpad driver Problem Types: Privilege escalation Description: An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-14390
CVE ID: CVE-2017-3758 State: PUBLISHED Published: 2017-10-17T20:00:00Z Last Updated: 2024-09-16T22:45:00.460Z Vendors: Lenovo Group Ltd. Products: Service Framework application Problem Types: Remote code execution Description: Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-15374
CVE ID: CVE-2017-3759 State: PUBLISHED Published: 2017-10-17T20:00:00Z Last Updated: 2024-09-16T19:19:06.707Z Vendors: Lenovo Group Ltd. Products: Service Framework application Problem Types: Remote code execution Description: The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the application to man-in-the-middle attacks leading to possible remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-15374