Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-20851 State: PUBLISHED Published: 2022-09-30T18:46:10.294145Z Last Updated: 2024-11-01T18:50:35.156Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-77 Description: A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI API. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system
b UI API. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To exploit this vulnerability, an attacker must have valid Administrator privileges on the affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webui-cmdinj-Gje47EMn
CVE ID: CVE-2022-20852 State: PUBLISHED Published: 2022-08-10T08:10:40.232275Z Last Updated: 2024-11-01T18:55:34.151Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Webex Meetings Problem Types: CWE-1021 Description: Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security
CVE ID: CVE-2022-20853 State: PUBLISHED Published: 2024-11-15T15:27:23.911Z Last Updated: 2024-11-15T16:49:00.733Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco TelePresence Video Communication Server (VCS) Expressway Problem Types: CWE-352 Description: A vulnerability in the REST API of Cisco&nbsp;Expressway Series and Cisco&nbsp;TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by
otections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload. Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.&nbsp; Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU - htt
- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-bw-thinrcpt-xss-gSj4CecU - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cssm-priv-esc-SEjz69dv - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-8PdRU8t8
CVE ID: CVE-2022-20854 State: PUBLISHED Published: 2022-11-10T17:31:14.744Z Last Updated: 2024-08-03T02:24:50.053Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Firepower Management Center, Cisco Firepower Threat Defense Software Problem Types: CWE-400 Description: A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper error handling when an SSH session fails to be established. An attacker could
ce. This vulnerability is due to improper error handling when an SSH session fails to be established. An attacker could exploit this vulnerability by sending a high rate of crafted SSH connections to the instance. A successful exploit could allow the attacker to cause resource exhaustion, resulting in a reboot on the affected device. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-dos-OwEunWJN
CVE ID: CVE-2022-20855 State: PUBLISHED Published: 2022-09-30T18:46:15.252083Z Last Updated: 2024-11-01T18:50:27.164Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-266 Description: A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the access point. This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could expl
This vulnerability is due to improper checks throughout the restart of certain system processes. An attacker could exploit this vulnerability by logging on to an affected device and executing certain CLI commands. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS as root. To successfully exploit this vulnerability, an attacker would need valid credentials for a privilege level 15 user of the wireless controller. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ewc-priv-esc-nderYLtK
CVE ID: CVE-2022-20856 State: PUBLISHED Published: 2022-09-30T18:46:20.043029Z Last Updated: 2024-11-01T18:50:19.273Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-664 Description: A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to a logic error and improper management of resources related to the handling of CAPWAP Mobility
s vulnerability is due to a logic error and improper management of resources related to the handling of CAPWAP Mobility messages. An attacker could exploit this vulnerability by sending crafted CAPWAP Mobility packets to an affected device. A successful exploit could allow the attacker to exhaust resources on the affected device. This would cause the device to reload, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-c9800-mob-dos-342YAc6J
CVE ID: CVE-2022-20857 State: PUBLISHED Published: 2022-07-21T03:45:54.352508Z Last Updated: 2024-11-01T18:59:35.819Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Nexus Dashboard Problem Types: CWE-306 Description: Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/sec
y. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ndb-mhcvuln-vpsBPJ9y
CVE ID: CVE-2022-20858 State: PUBLISHED Published: 2022-07-21T03:45:49.459402Z Last Updated: 2024-11-01T18:59:43.510Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Nexus Dashboard Problem Types: CWE-306 Description: Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/sec
CVE ID: CVE-2022-20859 State: PUBLISHED Published: 2022-07-06T20:30:56.958683Z Last Updated: 2024-11-06T16:11:17.930Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Cisco Products: Cisco Unified Communications Manager Problem Types: CWE-284 Description: A vulnerability in the Disaster Recovery framework of Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), and Cisco Unity Connection could allow an authenticated, remote attacker to perform certain administrative actions they should not be able to. This vulnerability is due to insufficient access control checks on the affect
rative actions they should not be able to. This vulnerability is due to insufficient access control checks on the affected device. An attacker with read-only privileges could exploit this vulnerability by executing a specific vulnerable command on an affected device. A successful exploit could allow the attacker to perform a set of administrative actions they should not be able to. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-access-dMKvV2DY
CVE ID: CVE-2022-20860 State: PUBLISHED Published: 2022-07-21T03:45:44.339502Z Last Updated: 2024-11-01T18:59:51.085Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Nexus Dashboard Problem Types: CWE-295 Description: A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus Dashboard is establishing a connection to Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud APIC, or Cisco Nexus
establishing a connection to Cisco Application Policy Infrastructure Controller (APIC), Cisco Cloud APIC, or Cisco Nexus Dashboard Fabric Controller, formerly Data Center Network Manager (DCNM) controllers. An attacker could exploit this vulnerability by using man-in-the-middle techniques to intercept the traffic between the affected device and the controllers, and then using a crafted certificate to impersonate the controllers. A successful exploit could allow the attacker to alter communications between devices or view sensitive information, including Administrator credentials for these controllers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
tials for these controllers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nd-tlsvld-TbAQLp3N
CVE ID: CVE-2022-20861 State: PUBLISHED Published: 2022-07-21T03:45:38.914006Z Last Updated: 2024-11-01T18:59:58.270Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Nexus Dashboard Problem Types: CWE-306 Description: Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/sec
CVE ID: CVE-2022-20862 State: PUBLISHED Published: 2022-07-06T20:31:02.944151Z Last Updated: 2024-11-06T16:11:00.685Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Cisco Products: Cisco Unified Communications Manager Problem Types: CWE-23 Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system of an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could e
stem of an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains directory traversal character sequences to an affected system. A successful exploit could allow the attacker to access sensitive files on the operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucm-file-read-qgjhEc3A
CVE ID: CVE-2022-20863 State: PUBLISHED Published: 2022-09-08T12:30:19.186491Z Last Updated: 2024-11-06T16:07:11.915Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Webex Meetings Desktop App Problem Types: CWE-450 Description: A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful
ndering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-qrtO6YC2
CVE ID: CVE-2022-20864 State: PUBLISHED Published: 2022-10-10T20:43:16.392597Z Last Updated: 2024-11-01T18:49:04.147Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco IOS XE Software Problem Types: CWE-538 Description: A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is due to a problem with the file and boot variable permissions in ROMMON. An attacker could exploit this vulnerability by rebooting the switch into ROMMON and entering s
e permissions in ROMMON. An attacker could exploit this vulnerability by rebooting the switch into ROMMON and entering specific commands through the console. A successful exploit could allow the attacker to read any file or reset the enable password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxe-info-disc-nrORXjO
CVE ID: CVE-2022-20865 State: PUBLISHED Published: 2022-08-25T18:40:16.485342Z Last Updated: 2024-11-06T16:07:46.975Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Firepower Extensible Operating System (FXOS) Problem Types: CWE-78 Description: A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The attacker would need to have Administrator privileges on the device. This vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a d
input validation of commands supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input to the affected command. A successful exploit could allow the attacker to execute commands on the underlying operating system with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fxos-cmdinj-TxcLNZNH
CVE ID: CVE-2022-20866 State: PUBLISHED Published: 2022-08-10T16:20:19.803227Z Last Updated: 2024-11-01T18:54:32.713Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-203 Description: A vulnerability in the handling of RSA keys on devices running Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to retrieve an RSA private key. This vulnerability is due to a logic error when the RSA key is stored in memory on a hardware platform that performs hardware-based cryptography. An attacker c
ror when the RSA key is stored in memory on a hardware platform that performs hardware-based cryptography. An attacker could exploit this vulnerability by using a Lenstra side-channel attack against the targeted device. A successful exploit could allow the attacker to retrieve the RSA private key. The following conditions may be observed on an affected device: This vulnerability will apply to approximately 5 percent of the RSA keys on a device that is running a vulnerable release of Cisco ASA Software or Cisco FTD Software; not all RSA keys are expected to be affected due to mathematical calculations applied to the RSA key. The RSA key could be valid but have specific characteristics that ma
o mathematical calculations applied to the RSA key. The RSA key could be valid but have specific characteristics that make it vulnerable to the potential leak of the RSA private key. If an attacker obtains the RSA private key, they could use the key to impersonate a device that is running Cisco ASA Software or Cisco FTD Software or to decrypt the device traffic. See the Indicators of Compromise section for more information on the detection of this type of RSA key. The RSA key could be malformed and invalid. A malformed RSA key is not functional, and a TLS client connection to a device that is running Cisco ASA Software or Cisco FTD Software that uses the malformed RSA key will result in a TL
to a device that is running Cisco ASA Software or Cisco FTD Software that uses the malformed RSA key will result in a TLS signature failure, which means a vulnerable software release created an invalid RSA signature that failed verification. If an attacker obtains the RSA private key, they could use the key to impersonate a device that is running Cisco ASA Software or Cisco FTD Software or to decrypt the device traffic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-rsa-key-leak-Ms7UEfZz
CVE ID: CVE-2022-20867 State: PUBLISHED Published: 2022-11-03T19:28:53.428Z Last Updated: 2024-11-20T14:32:35.941Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Secure Email, Cisco Secure Email and Web Manager Problem Types: CWE-89 Description: A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct SQL injection attacks as root on an affected system. The attacker must have the credentials of a high-privileged user account. This vulnerability is due to improper validation of user-submitted parameters. An a
s of a high-privileged user account. This vulnerability is due to improper validation of user-submitted parameters. An attacker could exploit this vulnerability by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database of the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD
CVE ID: CVE-2022-20868 State: PUBLISHED Published: 2022-11-03T19:29:31.722Z Last Updated: 2024-08-03T02:24:50.239Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Cisco Products: Cisco Secure Web Appliance, Cisco Secure Email, Cisco Secure Email and Web Manager Problem Types: CWE-321 Description: A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance could allow an authenticated, remote attacker to elevate privileges on an affected system. The attacker needs valid credentials to exploit this vulnerability. This vulnerability is due to the use of a hardcoded va
e attacker needs valid credentials to exploit this vulnerability. This vulnerability is due to the use of a hardcoded value to encrypt a token used for certain APIs calls . An attacker could exploit this vulnerability by authenticating to the device and sending a crafted HTTP request. A successful exploit could allow the attacker to impersonate another valid user and execute commands with the privileges of that user account. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esasmawsa-vulns-YRuSW5mD
CVE ID: CVE-2022-20869 State: PUBLISHED Published: 2022-08-10T08:10:58.896257Z Last Updated: 2024-11-01T18:55:26.689Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco BroadWorks Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interfa
properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-broadworks-xss-xbhfr4cD