Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-15380 State: PUBLISHED Published: 2019-02-20T23:00:00Z Last Updated: 2024-11-20T17:28:10.784Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco HyperFlex HX-Series Problem Types: CWE-78 Description: A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster service manager and injecting commands into the bound process. A successful exploit could allow the attacker to run commands on the affe
and injecting commands into the bound process. A successful exploit could allow the attacker to run commands on the affected host as the root user. This vulnerability affects Cisco HyperFlex Software releases prior to 3.5(2a). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/107095 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-hyperflex-injection
CVE ID: CVE-2018-15381 State: PUBLISHED Published: 2018-11-08T17:00:00Z Last Updated: 2024-11-26T14:22:53.464Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Unity Express Problem Types: CWE-502 Description: A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RM
loit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1042130 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue - http://www.securityfocus.com/bid/105876
CVE ID: CVE-2018-15382 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:34:45.791Z Vendors: Cisco Products: Cisco HyperFlex HX-Series Problem Types: CWE-642 Description: A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing key that is present in all Cisco HyperFlex systems. An attacker could exploit this vulnerability by accessing the static signing key from one HyperFlex system and using it to generate valid, signed session tokens for another HyperFlex system. A successful exploit could allow the attacker to access the HyperFlex Web UI of
on tokens for another HyperFlex system. A successful exploit could allow the attacker to access the HyperFlex Web UI of a system for which they are not authorized. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-secret - http://www.securityfocus.com/bid/105518
CVE ID: CVE-2018-15383 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:34:37.308Z Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-400 Description: A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resourc
devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained, high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device, which could cause the device to reload and result in a temporary DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1041787 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-as
uritytracker.com/id/1041787 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-asa-dma-dos
CVE ID: CVE-2018-15386 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:34:27.670Z Vendors: Cisco Products: Cisco Digital Network Architecture Center (DNA Center) Problem Types: CWE-16 Description: A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files. Add
onnecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105504 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-dna-unauth-access
CVE ID: CVE-2018-15387 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:34:17.730Z Vendors: Cisco Products: Cisco SD-WAN Solution Problem Types: CWE-20 Description: A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by supplying a system image signed with a crafted certificate to an affected device, bypassing the certificate validation. An exploit could allow an attacker to deploy a crafted system image. Additional Analyst Notes: - CVE Program Container: - CISA AD
t could allow an attacker to deploy a crafted system image. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-sd-wan-bypass - http://www.securityfocus.com/bid/105509
CVE ID: CVE-2018-15388 State: PUBLISHED Published: 2019-05-03T14:30:13.092336Z Last Updated: 2024-11-19T19:10:11.904Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-400 Description: A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load for existing WebVPN login operations. An attacker could exploit this vulnerability by sending m
xcessive processing load for existing WebVPN login operations. An attacker could exploit this vulnerability by sending multiple WebVPN login requests to the device. A successful exploit could allow the attacker to increase CPU load on the device, resulting in a denial of service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190501-sd-cpu-dos
CVE ID: CVE-2018-15389 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:33:58.427Z Vendors: Cisco Products: Cisco Prime Collaboration Provisioning Problem Types: CWE-255 Description: A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. The vulnerability is due to a hard-coded password that, in some cases, is not replaced with a unique password. A successful exploit could allow the attacker to access the administrative web interface with administrator-level privil
A successful exploit could allow the attacker to access the administrative web interface with administrator-level privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-cpcp-password
CVE ID: CVE-2018-15390 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:33:49.682Z Vendors: Cisco Products: Cisco Firepower Threat Defense Software Problem Types: CWE-399 Description: A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software fails to release spinlocks when a device is running low on system memory, if the software is configured to apply FTP inspection and an access control rule to transit traffic, and the access control rule
oftware is configured to apply FTP inspection and an access control rule to transit traffic, and the access control rule is associated with an FTP file policy. An attacker could exploit this vulnerability by sending a high rate of transit traffic through an affected device to cause a low-memory condition on the device. A successful exploit could allow the attacker to cause a software panic on the affected device, which could cause the device to reload and result in a temporary DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ftd-inspect-dos - http://
ces: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ftd-inspect-dos - http://www.securityfocus.com/bid/105519
CVE ID: CVE-2018-15391 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:33:37.401Z Vendors: Cisco Products: Cisco Remote PHY Problem Types: CWE-399 Description: A vulnerability in certain IPv4 fragment-processing functions of Cisco Remote PHY Software could allow an unauthenticated, remote attacker to impact traffic passing through a device, potentially causing a denial of service (DoS) condition. The vulnerability is due to the affected software not validating and calculating certain numerical values in IPv4 packets that are sent to an affected device. An attacker could exploit this vulnerability by sending malformed IPv4 traffic to an affected device. A successf
device. An attacker could exploit this vulnerability by sending malformed IPv4 traffic to an affected device. A successful exploit could allow the attacker to disrupt the flow of certain IPv4 traffic passing through an affected device, which could result in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-phy-ipv4-dos
CVE ID: CVE-2018-15392 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:33:26.109Z Vendors: Cisco Products: Cisco Industrial Network Director Problem Types: CWE-399 Description: A vulnerability in the DHCP service of Cisco Industrial Network Director could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper handling of DHCP lease requests. An attacker could exploit this vulnerability by sending malicious DHCP lease requests to an affected application. A successful exploit could allow the attacker to cause the DHCP service to terminate, resulting in a DoS condition. Additional Analyst Notes:
could allow the attacker to cause the DHCP service to terminate, resulting in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ind-dos
CVE ID: CVE-2018-15393 State: PUBLISHED Published: 2018-11-08T17:00:00Z Last Updated: 2024-11-26T14:22:45.349Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Content Security Management Appliance (SMA) Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Content Security Management Appliance (SMA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An at
due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105858 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-sma-xss
CVE ID: CVE-2018-15394 State: PUBLISHED Published: 2018-11-08T17:00:00Z Last Updated: 2024-11-26T14:22:36.820Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Cisco Products: Cisco Stealthwatch Enterprise Problem Types: CWE-284 Description: A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system configuration. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. An
guration. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. An exploit could allow the attacker to gain unauthenticated access, resulting in elevated privileges in the SMC. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-smc-auth-bypass - http://www.securityfocus.com/bid/105853
CVE ID: CVE-2018-15395 State: PUBLISHED Published: 2018-10-17T20:00:00Z Last Updated: 2024-11-26T14:25:18.018Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Wireless LAN Controller (WLC) Problem Types: CWE-284 Description: A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjacent attacker to gain network access to a Cisco TrustSec domain. Under normal circumstances, this access should be prohibited. The vulnerability is due to the dynamic assignment of Security Group Tags (SGTs) during a wireless roam from one Service Set Identifie
ity is due to the dynamic assignment of Security Group Tags (SGTs) during a wireless roam from one Service Set Identifier (SSID) to another within the Cisco TrustSec domain. An attacker could exploit this vulnerability by attempting to acquire an SGT from other SSIDs within the domain. Successful exploitation could allow the attacker to gain privileged network access that should be prohibited under normal circumstances. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181017-wlan-escalation - http://www.securitytracker.com/id/1041925 - http://www.securityfocus.com/bid/105
ory/cisco-sa-20181017-wlan-escalation - http://www.securitytracker.com/id/1041925 - http://www.securityfocus.com/bid/105676
CVE ID: CVE-2018-15396 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:33:14.989Z Vendors: Cisco Products: Cisco Unity Connection Problem Types: CWE-399 Description: A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to a
credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1041782 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-unity-dos
CVE ID: CVE-2018-15397 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:33:04.155Z Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-320 Description: A vulnerability in the implementation of Traffic Flow Confidentiality (TFC) over IPsec functionality in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error that may occur if the affected software renegotiates the encryption key for an IPsec tun
ulnerability is due to an error that may occur if the affected software renegotiates the encryption key for an IPsec tunnel when certain TFC traffic is in flight. An attacker could exploit this vulnerability by sending a malicious stream of TFC traffic through an established IPsec tunnel on an affected device. A successful exploit could allow the attacker to cause a daemon process on the affected device to crash, which could cause the device to crash and result in a DoS condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-asa-ipsec-dos - http://www.securityt
s://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-asa-ipsec-dos - http://www.securitytracker.com/id/1041786
CVE ID: CVE-2018-15398 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:32:55.787Z Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-284 Description: A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass an access control list (ACL) that is configured for an interface of an affected device. The vulnerability is due to errors that could occur when the affected software constructs and applies per-user-override rules. An attacker could exploit this vulnerability by connect
ffected software constructs and applies per-user-override rules. An attacker could exploit this vulnerability by connecting to a network through an affected device that has a vulnerable configuration. A successful exploit could allow the attacker to access resources that are behind the affected device and would typically be protected by the interface ACL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-asa-acl-bypass - http://www.securitytracker.com/id/1041788 - http://www.securityfocus.com/bid/105517
CVE ID: CVE-2018-15399 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:32:47.519Z Vendors: Cisco Products: Cisco Adaptive Security Appliance (ASA) Software Problem Types: CWE-400 Description: A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust the 1550-byte buffers on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a missing boundary check in an internal function. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between an aff
ernal function. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between an affected device and its configured TCP syslog server and then maliciously modifying the TCP header in segments that are sent from the syslog server to the affected device. A successful exploit could allow the attacker to exhaust buffer on the affected device and cause all TCP-based features to stop functioning, resulting in a DoS condition. The affected TCP-based features include AnyConnect SSL VPN, clientless SSL VPN, and management connections such as Secure Shell (SSH), Telnet, and HTTPS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
e Shell (SSH), Telnet, and HTTPS. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securitytracker.com/id/1041785 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-asa-syslog-dos
CVE ID: CVE-2018-15400 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:32:35.503Z Vendors: Cisco Products: Cisco Cloud Services Platform 2100 Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A succe
e. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/105560 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-csp-xss