Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
fying the device configuration. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an interface user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the device with the privileges of the user. Software versions prior to 8.3.150.0, 8.5.135.0, and 8.8.100.0 are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-csrf - http://www.securityfocus.com/bid/107998
CVE ID: CVE-2019-1798 State: PUBLISHED Published: 2019-04-08T19:30:17 Last Updated: 2024-11-19T19:12:05.892Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cisco Products: ClamAV Problem Types: CWE-20 Description: A vulnerability in the Portable Executable (PE) file scanning functionality of Clam AntiVirus (ClamAV) Software versions 0.101.1 and prior could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to th
s for PE files sent an affected device. An attacker could exploit this vulnerability by sending malformed PE files to the device running an affected version ClamAV Software. An exploit could allow the attacker to cause an out-of-bounds read condition, resulting in a crash that could result in a denial of service condition on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.clamav.net/show_bug.cgi?id=12262 - https://security.gentoo.org/glsa/201904-12
CVE ID: CVE-2019-1799 State: PUBLISHED Published: 2019-04-18T00:45:16.293711Z Last Updated: 2024-11-21T19:38:29.959Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Wireless LAN Controller (WLC) Problem Types: CWE-399 Description: A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability exist because the software improperly validates input on fields within IAPP messages. An attacker could exploit the vulnerability by sending malicious IAPP messages to an aff
CVE ID: CVE-2019-1800 State: PUBLISHED Published: 2019-04-18T01:00:15.745196Z Last Updated: 2024-11-21T19:38:08.906Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Wireless LAN Controller (WLC) Problem Types: CWE-399 Description: A vulnerability in the handling of Inter-Access Point Protocol (IAPP) messages by Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability exist because the software improperly validates input on fields within IAPP messages. An attacker could exploit the vulnerability by sending malicious IAPP messages to an aff
CVE ID: CVE-2019-1802 State: PUBLISHED Published: 2019-04-18T01:10:19.743516Z Last Updated: 2024-11-21T19:37:37.282Z Vendors: Cisco Products: Cisco Firepower Management Center Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input in the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user to access a report c
interface of the affected system. An attacker could exploit this vulnerability by persuading a user to access a report containing malicious content. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Versions 6.2.3, 6.3.0, and 6.4.0 are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-cfmc-xss - http://www.securityfocus.com/bid/107995
CVE ID: CVE-2019-1803 State: PUBLISHED Published: 2019-05-03T16:20:16.584226Z Last Updated: 2024-11-20T17:23:36.640Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode Problem Types: CWE-264 Description: A vulnerability in the filesystem management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an authenticated, local attacker with administrator rights to gain elevated privileges as the root user on an affected device. The vulnerability is due to overly permissive file permissions of specific system files. An attacker coul
fected device. The vulnerability is due to overly permissive file permissions of specific system files. An attacker could exploit this vulnerability by authenticating to an affected device, creating a crafted command string, and writing this crafted string to a specific file location. A successful exploit could allow the attacker to execute arbitrary operating system commands as root on an affected device. The attacker would need to have valid administrator credentials for the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-rpe
CVE ID: CVE-2019-1804 State: PUBLISHED Published: 2019-05-03T16:25:32.005358Z Last Updated: 2024-11-19T19:08:10.858Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software for Nexus 9000 Series Fabric Switches ACI Mode 11.0.1b Problem Types: CWE-310 Description: A vulnerability in the SSH key management for the Cisco Nexus 9000 Series Application Centric Infrastructure (ACI) Mode Switch Software could allow an unauthenticated, remote attacker to connect to the affected system with the privileges of the root user. The vulnerability is due to the presence of a default SSH key pair that is present in all devices. An attacker coul
ser. The vulnerability is due to the presence of a default SSH key pair that is present in all devices. An attacker could exploit this vulnerability by opening an SSH connection via IPv6 to a targeted device using the extracted key materials. An exploit could allow the attacker to access the system with the privileges of the root user. This vulnerability is only exploitable over IPv6; IPv4 is not vulnerable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-nexus9k-sshkey
CVE ID: CVE-2019-1805 State: PUBLISHED Published: 2019-04-18T01:10:13.454127Z Last Updated: 2024-11-21T19:37:47.586Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Wireless LAN Controller (WLC) Problem Types: CWE-284 Description: A vulnerability in certain access control mechanisms for the Secure Shell (SSH) server implementation for Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, adjacent attacker to access a CLI instance on an affected device. The vulnerability is due to a lack of proper input- and validation-checking mechanisms for inbound SSH connections on an affected device. An attacker could exploit
input- and validation-checking mechanisms for inbound SSH connections on an affected device. An attacker could exploit this vulnerability by attempting to establish an SSH connection to an affected controller. An exploit could allow the attacker to access an affected device's CLI to potentially cause further attacks. This vulnerability has been fixed in version 8.5(140.0). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190417-wlc-ssh - http://www.securityfocus.com/bid/108003
CVE ID: CVE-2019-1806 State: PUBLISHED Published: 2019-05-15T21:45:15.994826Z Last Updated: 2024-11-21T19:26:01.587Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco 550X Series Stackable Managed Switches Problem Types: CWE-20 Description: A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Small Business Sx200, Sx300, Sx500, ESW2 Series Managed Switches and Small Business Sx250, Sx350, Sx550 Series Switches could allow an authenticated, remote attacker to cause the SNMP application of an affected device to cease processing traffic, resulting in the CPU utilization reaching one hundred percent.
ation of an affected device to cease processing traffic, resulting in the CPU utilization reaching one hundred percent. Manual intervention may be required before a device resumes normal operations. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a malicious SNMP packet to an affected device. A successful exploit could allow the attacker to cause the device to cease forwarding traffic, which could result in a denial of service (DoS) condition. Cisco has released firmware updates that address this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
are updates that address this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-sb-snmpdos - http://www.securityfocus.com/bid/108335
CVE ID: CVE-2019-1807 State: PUBLISHED Published: 2019-05-03T16:25:25.486883Z Last Updated: 2024-11-20T17:23:19.248Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) Vendors: Cisco Products: Cisco Umbrella Problem Types: CWE-384 Description: A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session when a user authenticates to the application and changes the users credentials via another authenticated session. An attacker could exploit
cates to the application and changes the users credentials via another authenticated session. An attacker could exploit this vulnerability by using a separate, authenticated, active session to connect to the application through the web UI. A successful exploit could allow the attacker to maintain access to the dashboard via an authenticated user's browser session. Cisco has addressed this vulnerability in the Cisco Umbrella Dashboard. No user action is required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-udb-sm
CVE ID: CVE-2019-1808 State: PUBLISHED Published: 2019-05-15T22:15:30.009622Z Last Updated: 2024-11-20T17:19:27.801Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-347 Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by loading an unsigned software patch on an affected device. A suc
images. An attacker could exploit this vulnerability by loading an unsigned software patch on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv - http://www.securityfocus.com/bid/108367
CVE ID: CVE-2019-1809 State: PUBLISHED Published: 2019-05-15T22:15:23.669524Z Last Updated: 2024-11-20T17:19:35.902Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-347 Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks
images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-psvb - http://www.securityfocus.com/bid/108375
CVE ID: CVE-2019-1810 State: PUBLISHED Published: 2019-05-15T22:15:16.874528Z Last Updated: 2024-11-20T17:19:45.419Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-347 Description: A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command in Cisco Nexus 3000 Series and 9000 Series Switches could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit t
because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. Note: If the device has not been patched for the vulnerability previously disclosed in the Cisco Security Advisory cisco-sa-20190306-nxos-sig-verif, a successful exploit could allow the attacker to boot a malicious software image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv - http://www.securityfocus.com/bid/108431
CVE ID: CVE-2019-1811 State: PUBLISHED Published: 2019-05-15T22:20:32.758700Z Last Updated: 2024-11-20T17:18:58.154Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-347 Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image o
ified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv2 - http://www.securityfocus.com/bid/108425
CVE ID: CVE-2019-1812 State: PUBLISHED Published: 2019-05-15T22:20:26.162102Z Last Updated: 2024-11-20T17:19:07.317Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-347 Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image o
CVE ID: CVE-2019-1813 State: PUBLISHED Published: 2019-05-15T22:20:16.342103Z Last Updated: 2024-11-20T17:19:18.285Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco NX-OS Software Problem Types: CWE-347 Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image o
CVE ID: CVE-2019-1814 State: PUBLISHED Published: 2019-05-15T23:45:15.298126Z Last Updated: 2024-11-21T19:25:40.906Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Small Business 300 Series Managed Switches Problem Types: CWE-400 Description: A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthenticated, remote attacker to cause the device to become low on system memory, which in turn could lead to an unexpected reload of the device and result in a denial of service (DoS) condition on an affected device. The vulnerability is due to a fa
of the device and result in a denial of service (DoS) condition on an affected device. The vulnerability is due to a failure to free system memory when an unexpected DHCP request is received. An attacker could exploit this vulnerability by sending a crafted DHCP packet to the targeted device. A successful exploit could allow the attacker to cause an unexpected reload of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-sb300sms-dhcp - http://www.securityfocus.com/bid/108344
CVE ID: CVE-2019-1815 State: PUBLISHED Published: 2025-03-04T18:14:41.026Z Last Updated: 2025-03-04T18:29:27.408Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Cisco Products: Cisco Meraki MX Firmware Problem Types: CWE-200 Description: A security vulnerability was discovered in the local status page functionality of Cisco Meraki’s MX67 and MX68 security appliance models that may allow unauthenticated individuals to access and download logs containing sensitive, privileged device information. The vulnerability is due to improper access control to the files holding debugging and maintenance information, and is only exploitable when the local status page is en
rol to the files holding debugging and maintenance information, and is only exploitable when the local status page is enabled on the device. An attacker exploiting this vulnerability may obtain access to wireless pre-shared keys, Site-to-Site VPN key and other sensitive information. Under certain circumstances, this information may allow an attacker to obtain administrative-level access to the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://documentation.meraki.com/General_Administration/Privacy_and_Security/Cisco_Meraki_MX67_and_MX68_Sensitive_Information_Disclosure_Vulnerability
CVE ID: CVE-2019-1816 State: PUBLISHED Published: 2019-05-03T16:25:15.485549Z Last Updated: 2024-11-21T19:34:24.267Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Cisco Products: Cisco Web Security Appliance (WSA) Problem Types: CWE-20 Description: A vulnerability in the log subscription subsystem of the Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to perform command injection and elevate privileges to root. The vulnerability is due to insufficient validation of user-supplied input on the web and command-line interface. An attacker could exploit this vulnerability by authenticating to the affected device and injecting scr
-line interface. An attacker could exploit this vulnerability by authenticating to the affected device and injecting scripting commands in the scope of the log subscription subsystem. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-wsa-privesc
CVE ID: CVE-2019-1817 State: PUBLISHED Published: 2019-05-03T16:30:23.214365Z Last Updated: 2024-11-19T19:08:01.759Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Web Security Appliance (WSA) Problem Types: CWE-20 Description: A vulnerability in the web proxy functionality of Cisco AsyncOS Software for Cisco Web Security Appliance could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to improper validation of HTTP and HTTPS requests. An attacker could exploit this vulnerability by sending a malformed HTTP or HTTPS request to an affected device. An exp
An attacker could exploit this vulnerability by sending a malformed HTTP or HTTPS request to an affected device. An exploit could allow the attacker to cause a restart of the web proxy process, resulting in a temporary DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-wsa-dos
CVE ID: CVE-2019-1818 State: PUBLISHED Published: 2019-05-16T01:10:58.191024Z Last Updated: 2024-11-21T19:24:42.824Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco Prime Infrastructure Problem Types: CWE-22 Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit th
per sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1818 - http://www.securityfocus.com/bid/108352