Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-0420 State: PUBLISHED Published: 2018-10-17T22:00:00Z Last Updated: 2024-11-26T14:24:27.021Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cisco Products: Cisco Wireless LAN Controller (WLC) Problem Types: CWE-22 Description: A vulnerability in the web-based interface of Cisco Wireless LAN Controller Software could allow an authenticated, remote attacker to view sensitive information. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames and pathnames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location
ker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view system files on the targeted device, which may contain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105671 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlc-traversal - http://www.securitytracker.com/id/1041926
CVE ID: CVE-2018-0421 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:45:57.288Z Vendors: Cisco Products: Cisco Prime Access Registrar Problem Types: CWE-399 Description: A vulnerability in TCP connection management in Cisco Prime Access Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition when the application unexpectedly restarts. The vulnerability is due to incorrect handling of incoming TCP SYN packets to specific listening ports. The improper handling of the TCP SYN packets could cause a system file description to be allocated and not freed. An attacker could exploit this vulnerability by sending a crafted st
tem file description to be allocated and not freed. An attacker could exploit this vulnerability by sending a crafted stream of TCP SYN packets to the application. A successful exploit could allow the attacker to cause the application to eventually restart if a file description cannot be obtained. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cpar-dos - http://www.securitytracker.com/id/1041684 - http://www.securityfocus.com/bid/105282
CVE ID: CVE-2018-0422 State: PUBLISHED Published: 2018-10-05T14:00:00 Last Updated: 2024-11-26T14:45:46.774Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated, local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user. The vulnerability is due to folder permissions that grant a user the permission to read, write, and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory, affecting all other users of the targeted device. A succes
ility to write malicious files to the Webex client directory, affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges. Attacks on single-user systems are less likely to occur, as the attack must be carried out by the user on the user's own system. Multiuser systems have a higher risk of exploitation because folder permissions have an impact on all users of the device. For an attacker to exploit this vulnerability successfully, a second user must execute the locally installed malicious file to allow remote code execution to occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
ow remote code execution to occur. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105281 - http://www.securitytracker.com/id/1041681 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-pe
CVE ID: CVE-2018-0423 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:45:30.758Z Vendors: Cisco Products: Cisco RV130W Wireless-N Multifunction VPN Router Firmware Problem Types: CWE-119 Description: A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to cause a denial of service condition or to execute arbitrary code. The vulnerability is due to improper boundary restrictions on user-supplied input in the Guest user feature of the web-based management interface. An attacker could e
restrictions on user-supplied input in the Guest user feature of the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device, triggering a buffer overflow condition. A successful exploit could allow the attacker to cause the device to stop responding, resulting in a denial of service condition, or could allow the attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-overflow - http://www.securityfocus.com/bid/105285 - http://www.securitytracker.com/id/1
ry/cisco-sa-20180905-rv-routers-overflow - http://www.securityfocus.com/bid/105285 - http://www.securitytracker.com/id/1041675
CVE ID: CVE-2018-0424 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:45:18.676Z Vendors: Cisco Products: Cisco RV130W Wireless-N Multifunction VPN Router Firmware Problem Types: CWE-77 Description: A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an authenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input to scripts by the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a target
e web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the root user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1041677 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-injection
CVE ID: CVE-2018-0425 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:45:05.994Z Vendors: Cisco Products: Cisco RV130W Wireless-N Multifunction VPN Router Firmware Problem Types: CWE-200 Description: A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper access control to files within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted d
b-based management interface. An attacker could exploit this vulnerability by sending malicious requests to a targeted device. A successful exploit could allow the attacker to gain access to sensitive configuration information, including user authentication credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-disclosure - http://www.securitytracker.com/id/1041676
CVE ID: CVE-2018-0426 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:44:52.655Z Vendors: Cisco Products: Cisco RV130W Wireless-N Multifunction VPN Router Firmware Problem Types: CWE-22 Description: A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within the web-based management interface. An attacker could exploit this vulnerability by sending malic
acter sequences within the web-based management interface. An attacker could exploit this vulnerability by sending malicious requests to the targeted device. A successful exploit could allow the attacker to gain access to arbitrary files on the affected device, resulting in the disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-traversal - http://www.securitytracker.com/id/1041678
CVE ID: CVE-2018-0427 State: PUBLISHED Published: 2018-08-15T20:00:00Z Last Updated: 2024-11-26T14:46:51.675Z Vendors: Cisco Systems, Inc. Products: Digital Network Architecture (DNA) Center Problem Types: CWE-77 Description: A vulnerability in the CronJob scheduler API of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to incorrect input validation of user-supplied data. An attacker could exploit this vulnerability by sending a malicious packet. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. Cisco Bug IDs: CSCvi42263. Additional Ana
t could allow the attacker to execute arbitrary commands with root privileges. Cisco Bug IDs: CSCvi42263. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105106 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-dna-injection
CVE ID: CVE-2018-0428 State: PUBLISHED Published: 2018-08-15T20:00:00Z Last Updated: 2024-11-26T14:46:37.413Z Vendors: Cisco Systems, Inc. Products: Web Security Appliance Problem Types: CWE-284 Description: A vulnerability in the account management subsystem of Cisco Web Security Appliance (WSA) could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. The vulnerability is due to improper implementation of access controls. An attacker could exploit this vulnerability by authenticating to the device as a specific user to gain the information needed to elevate privileges to root in a separate login shell. A
the device as a specific user to gain the information needed to elevate privileges to root in a separate login shell. A successful exploit could allow the attacker to escape the CLI subshell and execute system-level commands on the underlying operating system as root. Cisco Bug IDs: CSCvj93548. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105104 - http://www.securitytracker.com/id/1041536 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-wsa-escalation
CVE ID: CVE-2018-0429 State: PUBLISHED Published: 2018-08-09T20:00:00 Last Updated: 2024-11-26T14:49:10.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the Cisco Thor decoder before commit 18de8f9f0762c3a542b1122589edb8af859d9813 allows local users to cause a denial of service (segmentation fault) and execute arbitrary code via a crafted non-conformant Thor bitstream. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105059 - https://github.com/cisco/thor/commit/18de8f9f0762c3a542b1122589edb8af859d9813
CVE ID: CVE-2018-0430 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:44:41.318Z Vendors: Cisco Products: Cisco Unified Computing System E-Series Software (UCSE) Problem Types: CWE-77 Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software.
exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software. A successful exploit could allow the attacker to inject and execute arbitrary, system-level commands with root privileges on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1041686 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-cimc-injection
CVE ID: CVE-2018-0431 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:44:32.327Z Vendors: Cisco Products: Cisco Unified Computing System E-Series Software (UCSE) Problem Types: CWE-77 Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an authenticated, remote attacker to inject and execute arbitrary commands with root privileges on an affected device. The vulnerability is due to insufficient validation of command input by the affected software. An attacker could exploit this vulnerability by sending crafted commands to the web-based management interface of the affected software.
CVE ID: CVE-2018-0432 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:44:21.046Z Vendors: Cisco Products: Cisco SD-WAN Solution Problem Types: CWE-264 Description: A vulnerability in the error reporting feature of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected device. The vulnerability is due to a failure to properly validate certain parameters included within the error reporting application configuration. An attacker could exploit this vulnerability by sending a crafted command to the error reporting feature. A successful exploit could allow the attacker to gain root-level privileges and take fu
to the error reporting feature. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105296 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-escalation
CVE ID: CVE-2018-0433 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:44:07.519Z Vendors: Cisco Products: Cisco SD-WAN Solution Problem Types: CWE-77 Description: A vulnerability in the command-line interface (CLI) in the Cisco SD-WAN Solution could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the CLI utility. The attacker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands
cker must be authenticated to access the CLI utility. A successful exploit could allow the attacker to execute commands with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105295 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-injection
CVE ID: CVE-2018-0434 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:43:53.131Z Vendors: Cisco Products: Cisco SD-WAN Solution Problem Types: CWE-295 Description: A vulnerability in the Zero Touch Provisioning feature of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confident
affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-sd-wan-validation - http://www.securityfocus.com/bid/105294
CVE ID: CVE-2018-0435 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:43:38.813Z Vendors: Cisco Products: Cisco Umbrella Problem Types: CWE-287 Description: A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizations. The vulnerability is due to insufficient authentication configurations for the API interface of Cisco Umbrella. An attacker could exploit this vulnerability to view and potentially modify data for their organization or other organizations. A successful exploit could allow the attacker to read or modify data across multiple organizations. Additional
zations. A successful exploit could allow the attacker to read or modify data across multiple organizations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105283 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-api
CVE ID: CVE-2018-0436 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:43:27.625Z Vendors: Cisco Products: Cisco Webex Teams Problem Types: CWE-284 Description: A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify da
privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105301 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-id-mod
CVE ID: CVE-2018-0437 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:43:17.640Z Vendors: Cisco Products: Cisco Umbrella Problem Types: CWE-264 Description: A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user credentials. This vulnerability is due to improper implementation of file system permissions, which could allow non-administrative users to place files within restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restric
in restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restricted directory, which when executed by the ERC client, would run with Administrator privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/45339/ - http://www.securityfocus.com/bid/105292 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv
CVE ID: CVE-2018-0438 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:43:08.723Z Vendors: Cisco Products: Cisco Umbrella Problem Types: CWE-20 Description: A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user credentials. This vulnerability is due to improper implementation of file system permissions, which could allow non-administrative users to place files within restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restrict
n restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restricted directory, which when executed by the ERC client, would run with Administrator privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read - http://www.securityfocus.com/bid/105286 - https://www.exploit-db.com/exploits/45339/
CVE ID: CVE-2018-0439 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:42:58.108Z Vendors: Cisco Products: Cisco Meeting Server Problem Types: CWE-352 Description: A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attack
erability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1041680 - http://www.securityfocus.com/bid/105287 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-meeting-csrf
CVE ID: CVE-2018-0440 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:42:44.821Z Vendors: Cisco Products: Cisco Data Center Network Manager Problem Types: CWE-264 Description: A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by authenticating to the application and then sending a crafted HTTP request to the targeted application. A successful exploit could allow the a