Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-1914 State: PUBLISHED Published: 2019-08-07T05:50:11.911931Z Last Updated: 2024-11-20T17:14:57.430Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Small Business 220 Series Smart Plus Switches Problem Types: CWE-20 Description: A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious request to certain parts of the web management interface. To send the mal
loit this vulnerability by sending a malicious request to certain parts of the web management interface. To send the malicious request, the attacker needs a valid login session in the web management interface as a privilege level 15 user. Depending on the configuration of the affected switch, the malicious request must be sent via HTTP or HTTPS. A successful exploit could allow the attacker to execute arbitrary shell commands with the privileges of the root user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-inject - http://packetstormsecurity.com/files/15
m/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190806-sb220-inject - http://packetstormsecurity.com/files/154667/Realtek-Managed-Switch-Controller-RTL83xx-Stack-Overflow.html
CVE ID: CVE-2019-1915 State: PUBLISHED Published: 2019-10-02T19:06:56.094776Z Last Updated: 2024-11-21T19:10:23.865Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Cisco Products: Cisco Unified Communications Manager Problem Types: CWE-352 Description: A vulnerability in the web-based interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition (SME), Cisco Unified Communications Manager IM and Presence (Unified CM IM&amp;P) Service, and Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is
ated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protections by the affected software. An attacker could exploit this vulnerability by persuading a targeted user to click a malicious link. A successful exploit could allow the attacker to send arbitrary requests that could change the password of a targeted user. An attacker could then take unauthorized actions on behalf of the targeted user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191002-cucm-csrf
CVE ID: CVE-2019-1917 State: PUBLISHED Published: 2019-07-17T20:15:15.384964Z Last Updated: 2024-11-19T19:02:34.831Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cisco Products: Cisco Vision Dynamic Signage Director Problem Types: CWE-287 Description: A vulnerability in the REST API interface of Cisco Vision Dynamic Signage Director could allow an unauthenticated, remote attacker to bypass authentication on an affected system. The vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute a
lity by sending a crafted HTTP request to an affected system. A successful exploit could allow the attacker to execute arbitrary actions through the REST API with administrative privileges on the affected system. The REST API is enabled by default and cannot be disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cvdsd-wmauth - http://www.securityfocus.com/bid/109301
CVE ID: CVE-2019-1918 State: PUBLISHED Published: 2019-08-07T21:10:21.824782Z Last Updated: 2024-11-21T19:18:11.727Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco IOS XR Software Problem Types: CWE-20 Description: A vulnerability in the implementation of Intermediate System&ndash;to&ndash;Intermediate System (IS&ndash;IS) routing protocol functionality in Cisco IOS XR Software could allow an unauthenticated attacker who is in the same IS-IS area to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of IS&ndash;IS link-state protocol data units (PDUs). An attacker could exploit this vulnerability
incorrect processing of IS&ndash;IS link-state protocol data units (PDUs). An attacker could exploit this vulnerability by sending specific link-state PDUs to an affected system to be processed. A successful exploit could allow the attacker to cause incorrect calculations used in the weighted remote shared risk link groups (SRLG) or in the IGP Flexible Algorithm. It could also cause tracebacks to the logs or potentially cause the receiving device to crash the IS&ndash;IS process, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-i
nrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-iosxr-isis-dos-1918
CVE ID: CVE-2019-1919 State: PUBLISHED Published: 2019-07-17T20:20:18.898880Z Last Updated: 2024-11-20T17:15:25.131Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco FindIT Network Manager Problem Types: CWE-798 Description: A vulnerability in the Cisco FindIT Network Management Software virtual machine (VM) images could allow an unauthenticated, local attacker who has access to the VM console to log in to the device with a static account that has root privileges. The vulnerability is due to the presence of an account with static credentials in the underlying Linux operating system. An attacker could exploit this vulnerability by logging i
h static credentials in the underlying Linux operating system. An attacker could exploit this vulnerability by logging in to the command line of the affected VM with the static account. A successful exploit could allow the attacker to log in with root-level privileges. This vulnerability affects only Cisco FindIT Network Manager and Cisco FindIT Network Probe Release 1.1.4 if these products are using Cisco-supplied VM images. No other releases or deployment models are known to be vulnerable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred - http://ww
ces: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-cfnm-statcred - http://www.securityfocus.com/bid/109305
CVE ID: CVE-2019-1920 State: PUBLISHED Published: 2019-07-17T20:20:13.229582Z Last Updated: 2024-11-21T19:19:08.762Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Aironet Access Point Software Problem Types: CWE-20 Description: A vulnerability in the 802.11r Fast Transition (FT) implementation for Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected interface. The vulnerability is due to a lack of complete error handling condition for client authentication requests sent to a targeted interface configured for FT. An attacker could exploit this
dition for client authentication requests sent to a targeted interface configured for FT. An attacker could exploit this vulnerability by sending crafted authentication request traffic to the targeted interface, causing the device to restart unexpectedly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-aironet-dos - http://www.securityfocus.com/bid/109312
CVE ID: CVE-2019-1921 State: PUBLISHED Published: 2019-07-06T01:25:15.575359Z Last Updated: 2024-11-19T19:03:02.770Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Email Security Appliance (ESA) Problem Types: CWE-20 Description: A vulnerability in the attachment scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper input validation of the email body. An attacker could exploit this vulnerability by naming a malicious attachment with a specific pattern. A successful exploit could
r could exploit this vulnerability by naming a malicious attachment with a specific pattern. A successful exploit could allow the attacker to bypass configured content filters that would normally block the attachment. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-esa-bypass
CVE ID: CVE-2019-1922 State: PUBLISHED Published: 2019-07-06T01:25:11.206035Z Last Updated: 2024-11-21T19:19:37.597Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: Cisco Products: Cisco IP Phone 8800 Series Software Problem Types: CWE-476 Description: A vulnerability in Cisco SIP IP Phone Software for Cisco IP Phone 7800 Series and 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected phone. The vulnerability is due to insufficient validation of input Session Initiation Protocol (SIP) packets. An attacker could exploit this vulnerability by altering the SIP replies that are sent to the affect
ocol (SIP) packets. An attacker could exploit this vulnerability by altering the SIP replies that are sent to the affected phone during the registration process. A successful exploit could allow the attacker to cause the phone to reboot and not complete the registration process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-ip-phone-sip-dos
CVE ID: CVE-2019-1923 State: PUBLISHED Published: 2019-07-17T20:25:33.670678Z Last Updated: 2024-11-20T17:15:15.438Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco SPA525G2 5-line IP Phone Problem Types: CWE-77 Description: A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by accessing the configuration interface, which may require a password, and then accessing the device's physical interface and i
sing the configuration interface, which may require a password, and then accessing the device's physical interface and inserting a USB storage device. A successful exploit could allow the attacker to execute arbitrary commands on the device in an elevated security context. At the time of publication, this vulnerability affected Cisco Small Business SPA500 Series IP Phones firmware releases 7.6.2SR5 and prior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-spa500-command - http://www.securityfocus.com/bid/109294
CVE ID: CVE-2019-1924 State: PUBLISHED Published: 2019-08-07T21:10:17.142021Z Last Updated: 2024-11-20T17:14:38.714Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco WebEx WRF Player Problem Types: CWE-119 Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malici
(ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-webex-player
CVE ID: CVE-2019-1925 State: PUBLISHED Published: 2019-08-07T21:10:11.724873Z Last Updated: 2024-11-20T17:14:48.660Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco WebEx WRF Player Problem Types: CWE-119 Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malici
CVE ID: CVE-2019-1926 State: PUBLISHED Published: 2019-08-07T21:15:20.992748Z Last Updated: 2024-11-20T17:14:21.022Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco WebEx WRF Player Problem Types: CWE-119 Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malici
CVE ID: CVE-2019-1927 State: PUBLISHED Published: 2019-08-07T21:15:15.785775Z Last Updated: 2024-11-20T17:14:30.539Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco WebEx WRF Player Problem Types: CWE-119 Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malici
CVE ID: CVE-2019-1928 State: PUBLISHED Published: 2019-08-07T21:20:26.084941Z Last Updated: 2024-11-20T17:13:46.006Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco WebEx WRF Player Problem Types: CWE-119 Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malici
CVE ID: CVE-2019-1929 State: PUBLISHED Published: 2019-08-07T21:20:21.397244Z Last Updated: 2024-11-20T17:13:55.291Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco WebEx WRF Player Problem Types: CWE-119 Description: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by sending a user a malici
CVE ID: CVE-2019-1930 State: PUBLISHED Published: 2019-07-06T01:30:29.192070Z Last Updated: 2024-11-21T19:19:18.922Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Firepower Management Center Problem Types: CWE-79 Description: Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of
. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected device. An attacker could exploit these vulnerabilities by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-fmc-xss
CVE ID: CVE-2019-1931 State: PUBLISHED Published: 2019-07-06T01:30:24.918871Z Last Updated: 2024-11-21T19:19:28.533Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Firepower Management Center Problem Types: CWE-79 Description: Multiple vulnerabilities in the RSS dashboard in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of
CVE ID: CVE-2019-1932 State: PUBLISHED Published: 2019-07-06T01:30:20.590608Z Last Updated: 2024-11-20T17:15:33.376Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco AMP for Endpoints Problem Types: CWE-345 Description: A vulnerability in Cisco Advanced Malware Protection (AMP) for Endpoints for Windows could allow an authenticated, local attacker with administrator privileges to execute arbitrary code. The vulnerability is due to insufficient validation of dynamically loaded modules. An attacker could exploit this vulnerability by placing a file in a specific location in the Windows filesystem. A successful exploit could allow the attac
erability by placing a file in a specific location in the Windows filesystem. A successful exploit could allow the attacker to execute the code with the privileges of the AMP service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-amp-commandinj
CVE ID: CVE-2019-1933 State: PUBLISHED Published: 2019-07-06T01:30:16.355593Z Last Updated: 2024-11-19T19:02:53.165Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Cisco Products: Cisco Email Security Appliance (ESA) Problem Types: CWE-20 Description: A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured filters on the device. The vulnerability is due to improper input validation of certain email fields. An attacker could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful
er could exploit this vulnerability by sending a crafted email message to a recipient protected by the ESA. A successful exploit could allow the attacker to bypass configured message filters and inject arbitrary scripting code inside the email body. The malicious code is not executed by default unless the recipient's email client is configured to execute scripts contained in emails. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190703-esa-filterpass
CVE ID: CVE-2019-1934 State: PUBLISHED Published: 2019-08-07T21:20:16.786859Z Last Updated: 2024-11-20T17:14:04.315Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-285 Description: A vulnerability in the web-based management interface of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to elevate privileges and execute administrative functions on an affected device. The vulnerability is due to insufficient authorization validation. An attacker could exploit this vulnerability by logging in to an affected device as a low-privileged
zation validation. An attacker could exploit this vulnerability by logging in to an affected device as a low-privileged user and then sending specific HTTPS requests to execute administrative functions using the information retrieved during initial login. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-asa-privescala
CVE ID: CVE-2019-1935 State: PUBLISHED Published: 2019-08-21T18:25:23.444802Z Last Updated: 2024-11-19T19:00:31.792Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Unified Computing System Director Problem Types: CWE-798 Description: A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an unauthenticated, remote attacker to log in to the CLI of an affected system by using the SCP User account (scpuser), which has default user credentials. The vulnerability is due to the presence of a documented default account with an undocumented defau
lt user credentials. The vulnerability is due to the presence of a documented default account with an undocumented default password and incorrect permission settings for that account. Changing the default password for this account is not enforced during the installation of the product. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to execute arbitrary commands with the privileges of the scpuser account. This includes full read and write access to the system's database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/cent
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190821-imcs-usercred - https://seclists.org/bugtraq/2019/Aug/49 - http://packetstormsecurity.com/files/154239/Cisco-UCS-IMC-Supervisor-Authentication-Bypass-Command-Injection.html - http://seclists.org/fulldisclosure/2019/Aug/36 - http://packetstormsecurity.com/files/154305/Cisco-UCS-Director-Default-scpuser-Password.html