Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
attackers to perform bruteforce session guessing attacks. Additional Analyst Notes: - CVE Program Container: References: - http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
CVE ID: CVE-2018-1244 State: PUBLISHED Published: 2018-07-02T17:00:00Z Last Updated: 2024-09-16T16:53:27.629Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Dell EMC Products: iDRAC7, iDRAC8, iDRAC9 Problem Types: Command injection vulnerability in the SNMP agent. Description: Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious iDRAC user with configuration privileges could potentially exploit this vulnerability to execute arbitrary commands on the iDRAC where SNMP alerting is enabled. Additional Analyst Notes: - CVE Program
lity to execute arbitrary commands on the iDRAC where SNMP alerting is enabled. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104964 - http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
CVE ID: CVE-2018-1245 State: PUBLISHED Published: 2018-07-13T17:00:00Z Last Updated: 2024-09-16T20:31:17.873Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: RSA Products: RSA Identity Governance and Lifecycle Problem Types: Authorization ByPass Vulnerability Description: RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application
licies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041287 - http://seclists.org/fulldisclosure/2018/Jul/46
CVE ID: CVE-2018-1246 State: PUBLISHED Published: 2018-09-28T18:00:00Z Last Updated: 2024-09-17T03:14:02.750Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Dell EMC Products: Dell EMC Unity, Dell EMC UnityVSA Problem Types: Reflected Cross-site Scripting (XSS) Description: Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser. Additional Analyst Notes: - CVE Program Container: Refe
en reflected back to the victim and executed by the web browser. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/30
CVE ID: CVE-2018-1247 State: PUBLISHED Published: 2018-05-08T13:00:00Z Last Updated: 2024-09-16T16:39:05.452Z Vendors: Dell EMC Products: RSA Authentication Manager Security Console Problem Types: XML External Entity Injection Vulnerability Description: RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin users to cause a denial of service or extract server data via injecting a maliciously crafted DTD in an XML file submitted to the application. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/18 - http://www.securitytracker.com/i
- CVE Program Container: References: - http://seclists.org/fulldisclosure/2018/May/18 - http://www.securitytracker.com/id/1040835 - http://www.securityfocus.com/bid/104107 - https://www.exploit-db.com/exploits/44634/
CVE ID: CVE-2018-1248 State: PUBLISHED Published: 2018-05-08T13:00:00Z Last Updated: 2024-09-16T16:13:25.346Z Vendors: Dell EMC Products: RSA Authentication Manager Security Console, Operation Console and Self-Service Console Problem Types: Host Header Injection Vulnerability Description: RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulnerability. This could allow a remote attacker to potentially poison HTTP cache and subsequently redirect users to arbitrary web domains. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104113 - http://se
ns. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104113 - http://seclists.org/fulldisclosure/2018/May/18 - http://www.securitytracker.com/id/1040835
CVE ID: CVE-2018-1249 State: PUBLISHED Published: 2018-07-02T17:00:00Z Last Updated: 2024-09-17T03:19:03.618Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Dell EMC Products: iDRAC9 Problem Types: SSL Strip Vulnerability Description: Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server. Additional Analyst Notes: - CVE Program Container: References: - http://en.community.dell.com/techcenter/extras/m/white_papers/20487494
CVE ID: CVE-2018-1250 State: PUBLISHED Published: 2018-09-28T18:00:00Z Last Updated: 2024-09-17T04:04:33.853Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Dell EMC Products: Dell EMC Unity, Dell EMC UnityVSA Problem Types: Authorization Bypass Description: Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains an Authorization Bypass vulnerability. A remote authenticated user could potentially exploit this vulnerability to read files in NAS server by directly interacting with certain APIs of Unity OE, bypassing Role-Based Authorization control implemented only in Unisphere GUI. Additional Analyst Notes: - CVE Program Container: References
d Authorization control implemented only in Unisphere GUI. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/30
CVE ID: CVE-2018-1251 State: PUBLISHED Published: 2018-09-28T18:00:00Z Last Updated: 2024-09-16T18:03:36.680Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: Dell EMC Products: Dell EMC Unity, Dell EMC UnityVSA Problem Types: URL Redirection Description: Dell EMC Unity and UnityVSA versions prior to 4.3.1.1525703027 contains a URL Redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect Unity users to arbitrary web URLs by tricking the victim user to click on a maliciously crafted Unisphere URL. Attacker could potentially phish information, including Unisphere users' credentials, from the victim once
nisphere URL. Attacker could potentially phish information, including Unisphere users' credentials, from the victim once they are redirected. Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/fulldisclosure/2018/Sep/30
CVE ID: CVE-2018-1252 State: PUBLISHED Published: 2018-06-05T12:00:00Z Last Updated: 2024-09-17T03:32:36.574Z Vendors: RSA Products: Web Threat Detection Problem Types: SQL Injection Vulnerability Description: RSA Web Threat Detection versions prior to 6.4, contain an SQL injection vulnerability in the Administration and Forensics applications. An authenticated malicious user with low privileges could potentially exploit this vulnerability to execute SQL commands on the back-end database to gain unauthorized access to the tool's monitoring and user information by supplying specially crafted input data to the affected application. Additional Analyst Notes: - CVE Program Container: References:
specially crafted input data to the affected application. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041026 - http://www.securityfocus.com/bid/104396 - http://seclists.org/fulldisclosure/2018/Jun/4
CVE ID: CVE-2018-1253 State: PUBLISHED Published: 2018-06-21T15:00:00Z Last Updated: 2024-09-17T03:52:50.534Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: RSA Products: Authentication Manager Problem Types: xss vulnerability Description: RSA Authentication Manager Operation Console, versions 8.3 P1 and earlier, contains a stored cross-site scripting vulnerability. A malicious Operations Console administrator could potentially exploit this vulnerability to store arbitrary HTML or JavaScript code through the web interface. When other Operations Console administrators open the affected page, the injected scripts could potentially be executed in their browser
tions Console administrators open the affected page, the injected scripts could potentially be executed in their browser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104534 - http://www.securitytracker.com/id/1041134 - http://seclists.org/fulldisclosure/2018/Jun/39
CVE ID: CVE-2018-1254 State: PUBLISHED Published: 2018-06-21T15:00:00Z Last Updated: 2024-09-17T02:11:11.898Z Vendors: RSA Products: RSA Authentication Manager Problem Types: Reflected cross-site scripting vulnerability Description: RSA Authentication Manager Security Console, versions 8.3 P1 and earlier, contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim Security Console administrator to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. Additional Analyst Notes: - CVE Program Container: R
then reflected back to the victim and executed by the web browser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104534 - http://www.securitytracker.com/id/1041134 - http://seclists.org/fulldisclosure/2018/Jun/39
CVE ID: CVE-2018-1255 State: PUBLISHED Published: 2018-07-13T17:00:00Z Last Updated: 2024-09-17T02:16:59.328Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: RSA Products: RSA Identity Governance and Lifecycle Problem Types: Reflected Cross-Site Scripting Vulnerability Description: RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains a reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the
HTML or JavaScript code to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041287 - http://seclists.org/fulldisclosure/2018/Jul/46
CVE ID: CVE-2018-1256 State: PUBLISHED Published: 2018-05-07T15:00:00Z Last Updated: 2024-09-17T01:06:26.892Z Vendors: Pivotal Products: Spring Cloud SSO Connector Problem Types: Improper Access Control Description: Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of the SSO Connector with tokens generated from another service plan. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-1256
CVE ID: CVE-2018-1257 State: PUBLISHED Published: 2018-05-11T20:00:00Z Last Updated: 2024-09-16T22:56:18.536Z Vendors: Pivotal Products: Spring Framework Problem Types: ReDoS Description: Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104260 - https://access.redhat.com/e
lyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104260 - https://access.redhat.com/errata/RHSA-2018:1809 - https://access.redhat.com/errata/RHSA-2018:3768 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://pivotal.io/security/cve-2018-1257 - https://www.oracle.com/security-al
cle.com/security-alerts/cpujan2020.html - https://pivotal.io/security/cve-2018-1257 - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-1258 State: PUBLISHED Published: 2018-05-11T20:00:00Z Last Updated: 2024-09-17T02:56:37.459Z Vendors: Pivotal Products: Spring Framework Problem Types: Authorization Bypass Description: Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104222 - http://www.securitytracker.com/id/1041888 - http://www.securitytracker.com/id/1041896 - https://access.redhat.com/errata/RHSA-2019:2413 -
ytracker.com/id/1041888 - http://www.securitytracker.com/id/1041896 - https://access.redhat.com/errata/RHSA-2019:2413 - https://www.oracle.com/security-alerts/cpuapr2020.html - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://security
rk/security-advisory/cpujul2019-5072835.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://security.netapp.com/advisory/ntap-20181018-0002/ - https://pivotal.io/security/cve-2018-1258 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-1259 State: PUBLISHED Published: 2018-05-11T20:00:00Z Last Updated: 2024-09-16T16:33:36.641Z Vendors: Pivotal Products: Spring Data Commons Problem Types: XML Parsing Description: Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on t
crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1809 - https://access.redhat.com/errata/RHSA-2018:3768 - https://www.oracle.com/security-alerts/cpujul2022.html - https://pivotal.io/security/cve-2018-1259
CVE ID: CVE-2018-1260 State: PUBLISHED Published: 2018-05-11T20:00:00Z Last Updated: 2024-09-17T03:44:21.413Z Vendors: Pivotal Products: Spring Security OAuth Problem Types: Remote Code Execution Description: Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2
roval endpoint. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1809 - https://pivotal.io/security/cve-2018-1260 - https://access.redhat.com/errata/RHSA-2018:2939 - http://www.securityfocus.com/bid/104158
CVE ID: CVE-2018-1261 State: PUBLISHED Published: 2018-05-11T20:00:00Z Last Updated: 2024-09-17T01:46:47.886Z Vendors: Pivotal Products: Spring Integration Zip Problem Types: Directory Traversal Description: Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104178 - ht
et folder. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104178 - https://pivotal.io/security/cve-2018-1261
CVE ID: CVE-2018-1262 State: PUBLISHED Published: 2018-05-15T20:00:00Z Last Updated: 2024-09-16T17:08:52.142Z Vendors: Cloud Foundry Products: CloudFoundry UAA Problem Types: Privilege escalation Description: Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. A zone administrator could configure their zone to issue tokens which impersonate another zone, granting up to admin privileges in the impersonated zone for clients performing offline token validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-201
n validation. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1262/
CVE ID: CVE-2018-1263 State: PUBLISHED Published: 2018-05-15T20:00:00Z Last Updated: 2024-09-16T16:38:32.767Z Vendors: Pivotal Products: Spring Integration Zip Problem Types: Directory Traversal Description: Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Additional Analyst Notes: - CVE Program Container: Referenc
ectory, the final path ends up outside of the target folder. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104179 - https://pivotal.io/security/cve-2018-1263
CVE ID: CVE-2018-1264 State: PUBLISHED Published: 2018-10-05T21:00:00Z Last Updated: 2024-09-16T19:10:46.786Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Cloud Foundry Products: log-cache-release Problem Types: Information Exposure Through Log Files Description: Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation. Additional Analyst Notes: -
, if this client is an admin, the attacker would gain complete control over the Foundation. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1264/
CVE ID: CVE-2018-1265 State: PUBLISHED Published: 2018-06-06T20:00:00Z Last Updated: 2024-09-17T02:21:31.743Z Vendors: Cloud Foundry Products: Diego Problem Types: Directory Traversal Description: Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego Cell. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1265/
CVE ID: CVE-2018-1266 State: PUBLISHED Published: 2018-03-27T16:00:00Z Last Updated: 2024-09-16T23:16:38.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities. An authenticated malicious user can predict the location of application blobs and leverage path traversal to create a malicious application that has the ability to overwrite arbitrary files on the Cloud Controller instance. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1266/
CVE ID: CVE-2018-1267 State: PUBLISHED Published: 2018-03-27T16:00:00Z Last Updated: 2024-09-17T02:11:56.088Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloud Foundry Silk CNI plugin, versions prior to 0.2.0, contains an improper access control vulnerability. If the platform is configured with an application security group (ASG) that overlaps with the Silk overlay network, any applications can reach any other application on the network regardless of the configured routing policies. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1267/
CVE ID: CVE-2018-1268 State: PUBLISHED Published: 2018-06-06T20:00:00Z Last Updated: 2024-09-17T04:25:07.541Z Vendors: Cloud Foundry Products: Loggregator Problem Types: Authorization Error Description: Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests to read from or write to the logs of that app. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1268
CVE ID: CVE-2018-1269 State: PUBLISHED Published: 2018-06-06T20:00:00Z Last Updated: 2024-09-17T04:05:15.217Z Vendors: Cloud Foundry Products: Loggregator Problem Types: Denial of service Description: Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the traffic controller to leave dangling TCP connections, which could cause denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1269