Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-20811 State: PUBLISHED Published: 2022-10-26T14:00:20.814557Z Last Updated: 2024-10-25T16:05:48.346Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) Vendors: Cisco Products: Cisco RoomOS Software Problem Types: CWE-200 Description: Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
CVE ID: CVE-2022-20812 State: PUBLISHED Published: 2022-07-06T20:30:40.411834Z Last Updated: 2024-11-06T16:11:48.562Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: Cisco Products: Cisco TelePresence Video Communication Server (VCS) Expressway Problem Types: CWE-158 Description: Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway
affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-overwrite-3buqW8LH - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6
CVE ID: CVE-2022-20813 State: PUBLISHED Published: 2022-07-06T20:30:45.861457Z Last Updated: 2024-11-06T16:11:39.563Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) Vendors: Cisco Products: Cisco TelePresence Video Communication Server (VCS) Expressway Problem Types: CWE-158 Description: Multiple vulnerabilities in the API and in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow a remote attacker to overwrite arbitrary files or conduct null byte poisoning attacks on an affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway
affected device. Note: Cisco Expressway Series refers to the Expressway Control (Expressway-C) device and the Expressway Edge (Expressway-E) device. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-overwrite-3buqW8LH
CVE ID: CVE-2022-20814 State: PUBLISHED Published: 2024-11-15T15:32:47.058Z Last Updated: 2024-11-15T21:15:35.408Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco TelePresence Video Communication Server (VCS) Expressway Problem Types: CWE-295 Description: A vulnerability in the certificate validation of Cisco&nbsp;Expressway-C and Cisco&nbsp;TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data.&nbsp;&nbsp;The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco&nbsp;Unified Communicat
server certificate that an affected device receives when it establishes a connection to a Cisco&nbsp;Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic. Note: Cisco&nbsp;Expressway-E is not affected by this vulnerability.Cisco&nbsp;has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Additional Analyst Notes: - C
that address this vulnerability. There are no workarounds that address this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-sqpsSfY6 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-bng-Gmg5Gxt - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ncs4k-tl1-GNnLwC6 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-xr-cdp-wnALzvT2
CVE ID: CVE-2022-20815 State: PUBLISHED Published: 2022-07-06T20:30:51.324508Z Last Updated: 2024-11-06T16:11:27.337Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Unified Communications Manager Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Management Edition (Unified CM SME), and Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists
emote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-xss-ksKd5yfA
CVE ID: CVE-2022-20816 State: PUBLISHED Published: 2022-08-10T08:11:31.387075Z Last Updated: 2024-11-01T18:55:09.862Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Cisco Products: Cisco Unified Communications Manager Problem Types: CWE-22 Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an authenticated, remote attacker to delete arbitrary files from an affected system. This vulnerability exists because the affected software does not properly validate HTTP requests. An attacker could exploit
s vulnerability exists because the affected software does not properly validate HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to delete arbitrary files from the affected system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-file-delete-N2VPmOnE
CVE ID: CVE-2022-20817 State: PUBLISHED Published: 2022-06-15T17:55:32.726275Z Last Updated: 2024-11-01T19:02:31.240Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco IP Phones with Multiplatform Firmware Problem Types: CWE-338 Description: A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager (CUCM) is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerabili
t could result in duplicated manufactured keys installed on multiple devices. An attacker could exploit this vulnerability by performing a machine-in-the-middle attack on the secure communication between the phone and the CUCM. A successful exploit could allow the attacker to impersonate another user's phone. This vulnerability cannot be addressed with software updates. There is a workaround that addresses this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cp6901-dup-cert-82jdJGe4
CVE ID: CVE-2022-20818 State: PUBLISHED Published: 2022-09-30T18:45:36.170921Z Last Updated: 2024-11-01T18:51:20.116Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco SD-WAN Solution Problem Types: CWE-25 Description: Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a malicious command on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user.
nd on the application CLI. A successful exploit could allow the attacker to execute arbitrary commands as the root user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sd-wan-priv-E6e8tEdF
CVE ID: CVE-2022-20819 State: PUBLISHED Published: 2022-06-15T17:55:37.905038Z Last Updated: 2024-11-01T19:02:21.495Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco Identity Services Engine Software Problem Types: CWE-266 Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability exists because administrative privilege levels for sensitive data are not properly enforced. An attacker with read-only privileges for the web-based management interface on an affected device
t properly enforced. An attacker with read-only privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information about the system configuration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-info-disclosure-Os6fSd6N
CVE ID: CVE-2022-20820 State: PUBLISHED Published: 2022-08-10T08:11:49.472063Z Last Updated: 2024-11-01T18:54:58.521Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Webex Meetings Problem Types: CWE-1021 Description: Multiple vulnerabilities in the web interface of Cisco Webex Meetings could allow a remote attacker to conduct a cross-site scripting (XSS) attack or a frame hijacking attack against a user of the web interface. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-frmhijck-kO3wmkuS
CVE ID: CVE-2022-20821 State: PUBLISHED Published: 2022-05-26T14:00:31.613Z Last Updated: 2025-10-21T23:15:39.420Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco IOS XR Software Problem Types: CWE-200 Description: A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container. This vulnerability exists because the health check RPM opens TCP port 6379 by default upon activation. An attacker could exploit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attac
loit this vulnerability by connecting to the Redis instance on the open port. A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database. Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-redis-ABJyE5xK
CVE ID: CVE-2022-20822 State: PUBLISHED Published: 2022-10-26T14:00:26.541523Z Last Updated: 2024-10-15T15:59:22.925Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Cisco Products: Cisco Identity Services Engine Software Problem Types: CWE-22 Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to read and delete files on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains certain character sequences to an affected system. A
this vulnerability by sending a crafted HTTP request that contains certain character sequences to an affected system. A successful exploit could allow the attacker to read or delete specific files on the device that their configured administrative level should not have access to. Cisco plans to release software updates that address this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-path-trav-Dz5dpzyM - https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-path-traversal/
CVE ID: CVE-2022-20823 State: PUBLISHED Published: 2022-08-25T18:40:30.942730Z Last Updated: 2024-11-06T16:07:37.716Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-126 Description: A vulnerability in the OSPF version 3 (OSPFv3) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to incomplete input validation of specific OSPFv3 packets. An attacker could exploit this vulnerability by sending a malicious OSPFv3 link-state advertisement (LSA) to an affected device. A successful exploit
s vulnerability by sending a malicious OSPFv3 link-state advertisement (LSA) to an affected device. A successful exploit could allow the attacker to cause the OSPFv3 process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: The OSPFv3 feature is disabled by default. To exploit this vulnerability, an attacker must be able to establish a full OSPFv3 neighbor state with an affected device. For more information about exploitation conditions, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurity
Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ospfv3-dos-48qutcu
CVE ID: CVE-2022-20824 State: PUBLISHED Published: 2022-08-25T18:40:48.962538Z Last Updated: 2024-11-06T16:07:28.736Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-121 Description: A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper input validation of specific values that are within a Cisco Discovery Protocol message. An attacker could exploit this vul
put validation of specific values that are within a Cisco Discovery Protocol message. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or cause the Cisco Discovery Protocol process to crash and restart multiple times, which would cause the affected device to reload, resulting in a DoS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Additional Analyst Notes: - CVE Program Container: - CISA A
broadcast domain as the affected device (Layer 2 adjacent). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-cdp-dos-ce-wWvPucC9 - https://security.netapp.com/advisory/ntap-20220923-0001/
CVE ID: CVE-2022-20825 State: PUBLISHED Published: 2022-06-15T17:55:43.723759Z Last Updated: 2024-11-01T19:02:05.042Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Small Business RV Series Router Firmware Problem Types: CWE-121 Description: A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient user input validation of incoming HTTP packets. An attacker
(DoS) condition. This vulnerability is due to insufficient user input validation of incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on an affected device using root-level privileges. Cisco has not released software updates that address this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-rv-overflow-s2r82P9v
CVE ID: CVE-2022-20826 State: PUBLISHED Published: 2022-11-10T17:31:54.657Z Last Updated: 2024-08-03T02:24:50.027Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense Software Problem Types: CWE-501 Description: A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated attacker with physical access to the device to bypass the secure boot functionality. This vulnerability is due to a logic error
r with physical access to the device to bypass the secure boot functionality. This vulnerability is due to a logic error in the boot process. An attacker could exploit this vulnerability by injecting malicious code into a specific memory location during the boot process of an affected device. A successful exploit could allow the attacker to execute persistent code at boot time and break the chain of trust. Additional Analyst Notes: - CVE Program Container: References: - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fw3100-secure-boot-5M8mUh26
CVE ID: CVE-2022-20827 State: PUBLISHED Published: 2022-08-10T08:12:09.627719Z Last Updated: 2024-11-01T18:54:50.122Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Small Business RV Series Router Firmware Problem Types: CWE-120 Description: Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
ties, see the Details section of this advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sb-mult-vuln-CbVp4SUR
CVE ID: CVE-2022-20828 State: PUBLISHED Published: 2022-06-24T15:25:16.277268Z Last Updated: 2024-11-01T19:00:55.956Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco FirePOWER Services Software for ASA Problem Types: CWE-236 Description: A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerability is due to improper handling of undefined command parameters. An attacker could exploit this vulnerability
vulnerability is due to improper handling of undefined command parameters. An attacker could exploit this vulnerability by using a crafted command on the CLI or by submitting a crafted HTTPS request to the web-based management interface of the Cisco ASA that is hosting the ASA FirePOWER module. Note: To exploit this vulnerability, the attacker must have administrative access to the Cisco ASA. A user who has administrative access to a particular Cisco ASA is also expected to have administrative access to the ASA FirePOWER module that is hosted by that Cisco ASA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/c
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asasfr-cmd-inject-PE4GfdG - https://www.rapid7.com/blog/post/2022/08/11/rapid7-discovered-vulnerabilities-in-cisco-asa-asdm-and-firepower-services-software/ - http://packetstormsecurity.com/files/168256/Cisco-ASA-X-With-FirePOWER-Services-Authenticated-Command-Injection.html
CVE ID: CVE-2022-20829 State: PUBLISHED Published: 2022-06-24T15:25:10.668661Z Last Updated: 2024-11-01T19:01:05.229Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-345 Description: A vulnerability in the packaging of Cisco Adaptive Security Device Manager (ASDM) images and the validation of those images by Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker with administrative privileges to upload an ASDM image that contains malicious code to a device that is running Cisco ASA Software. This vulnerability is due to insufficient v