Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-12179 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-17T02:01:13.421Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://cgit.freedesktop.org/xorg/xserver/commit/?id=d088e3c1286b548a58e62afdc70bb40981cdb9e8 - https://www.debian.org/security/2017/dsa-4000 - https://security.gentoo.org/glsa/201711-05 - https://bugzilla.redhat.com/show_bug.cgi?id
an.org/security/2017/dsa-4000 - https://security.gentoo.org/glsa/201711-05 - https://bugzilla.redhat.com/show_bug.cgi?id=1509220
CVE ID: CVE-2017-12180 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-16T20:21:43.549Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857b - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-
1dbd857b - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-05 - https://bugzilla.redhat.com/show_bug.cgi?id=1509221
CVE ID: CVE-2017-12181 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-17T04:10:25.463Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1509222 - https://www.debian.org/security/2017/dsa-4000 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857b - https://security.gentoo.org/glsa/201711-05
CVE ID: CVE-2017-12182 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-16T23:11:10.194Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857b - https://bugzilla.redhat.com/show_bug.cgi?id=1509223 - https://lists.debian.org/debian-lts-announce/2017/11/msg00
d857b - https://bugzilla.redhat.com/show_bug.cgi?id=1509223 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-05
CVE ID: CVE-2017-12183 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-16T19:21:10.764Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-05 - htt
- https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201711-05 - https://bugzilla.redhat.com/show_bug.cgi?id=1509224
CVE ID: CVE-2017-12184 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-17T02:41:51.662Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://bugzilla.redhat.com/show_bug.cgi?id=1509225 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab64
nnounce/2017/11/msg00032.html - https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
CVE ID: CVE-2017-12185 State: PUBLISHED Published: 2018-01-24T15:00:00 Last Updated: 2024-08-05T18:28:16.638Z Vendors: n/a Products: n/a Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e - https://bugzilla.redhat.com/show_bug.cgi?id=1509215
CVE ID: CVE-2017-12186 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-17T00:46:33.148Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://bugzilla.redhat.com/show_bug.cgi?id=1509216 - https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
CVE ID: CVE-2017-12187 State: PUBLISHED Published: 2018-01-24T15:00:00Z Last Updated: 2024-09-16T19:30:41.654Z Vendors: The X.Org Foundation Products: xorg-x11-server Problem Types: CWE-391 Description: xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2017/dsa-4000 - https://bugzilla.redhat.com/show_bug.cgi?id=1509217 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d
ounce/2017/11/msg00032.html - https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
CVE ID: CVE-2017-12188 State: PUBLISHED Published: 2017-10-11T15:00:00 Last Updated: 2024-08-05T18:28:16.694Z Vendors: n/a Products: Linux kernel Problem Types: CWE-121 Description: arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entries to resolve a guest virtual address, which allows L1 guest OS users to execute arbitrary code on the host OS or cause a denial of service (incorrect index during page walking, and host OS crash), aka an "MMU potential stack buffer overrun." Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0412 - https://access.redhat
st Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0412 - https://access.redhat.com/errata/RHSA-2018:0395 - https://patchwork.kernel.org/patch/9996587/ - https://patchwork.kernel.org/patch/9996579/ - http://www.securityfocus.com/bid/101267 - https://bugzilla.redhat.com/show_bug.cgi?id=1500380
CVE ID: CVE-2017-12189 State: PUBLISHED Published: 2018-01-10T19:00:00Z Last Updated: 2024-08-05T18:28:16.689Z Vendors: Red Hat, Inc. Products: Red Hat JBoss Enterprise Application Platform Problem Types: CWE-282 Description: It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege escalation. This issue is a result of an incomplete fix for CVE-2016-8656. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12189 - https://access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2018:
ug.cgi?id=CVE-2017-12189 - https://access.redhat.com/errata/RHSA-2018:0002 - https://access.redhat.com/errata/RHSA-2018:0004 - https://access.redhat.com/errata/RHSA-2018:0003 - https://access.redhat.com/errata/RHSA-2018:0005 - http://www.securityfocus.com/bid/102407
CVE ID: CVE-2017-12190 State: PUBLISHED Published: 2017-11-22T18:00:00 Last Updated: 2024-08-05T18:28:16.645Z Vendors: n/a Products: Linux kernel through v4.14-rc5 Problem Types: CWE-400 Description: The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O vector has small consecutive buffers belonging to the same page. The bio_add_pc_page function merges them into one, but the page reference is never dropped. This causes a memory leak and possible system lockup (exploitable against the host OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition. Additi
OS by a guest OS user, if a SCSI disk is passed through to a virtual machine) due to an out-of-memory condition. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2b04e8f6bbb196cab4b232af0f8d48ff2c7a8058 - http://www.securityfocus.com/bid/101911 - https://lists.debian.org/debian-lts-announce/2017/12/msg00004.html - https://usn.ubuntu.com/3583-2/ - https://access.redhat.com/errata/RHSA-2018:1854 - https://usn.ubuntu.com/3582-1/ - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.8 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95d78c28b5a85bacbc29b8dba7c04babb9b0d467
3.8 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=95d78c28b5a85bacbc29b8dba7c04babb9b0d467 - https://access.redhat.com/errata/RHSA-2018:1062 - https://github.com/torvalds/linux/commit/95d78c28b5a85bacbc29b8dba7c04babb9b0d467 - https://access.redhat.com/errata/RHSA-2018:0654 - https://usn.ubuntu.com/3583-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1495089 - https://github.com/torvalds/linux/commit/2b04e8f6bbb196cab4b232af0f8d48ff2c7a8058 - http://seclists.org/oss-sec/2017/q4/52 - https://access.redhat.com/errata/RHSA-2018:0676 - https://usn.ubuntu.com/3582-2/ - https://access.redhat.com/errata/RHSA-2019:1170 - https://access.redhat.com/errata/RHSA-2019:1190
.ubuntu.com/3582-2/ - https://access.redhat.com/errata/RHSA-2019:1170 - https://access.redhat.com/errata/RHSA-2019:1190 - https://support.f5.com/csp/article/K93472064?utm_source=f5support&amp%3Butm_medium=RSS
CVE ID: CVE-2017-12191 State: PUBLISHED Published: 2018-02-28T13:00:00Z Last Updated: 2024-08-05T18:28:16.718Z Vendors: Red Hat, Inc. Products: CloudForms Problem Types: CWE-284 Description: A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://access.redha
at they should not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0374 - https://bugzilla.redhat.com/show_bug.cgi?id=1500517
CVE ID: CVE-2017-12192 State: PUBLISHED Published: 2017-10-12T00:00:00 Last Updated: 2024-08-05T18:28:16.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properly consider that a key may be possessed but negatively instantiated, which allows local users to cause a denial of service (OOPS and system crash) via a crafted KEYCTL_READ operation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1493435 - https://usn.ubuntu.com/3583-2/ - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.
.com/show_bug.cgi?id=1493435 - https://usn.ubuntu.com/3583-2/ - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.5 - https://usn.ubuntu.com/3583-1/ - https://access.redhat.com/errata/RHSA-2018:0151 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=37863c43b2c6464f252862bf2e9768264e961678 - https://github.com/torvalds/linux/commit/37863c43b2c6464f252862bf2e9768264e961678 - https://lkml.org/lkml/2017/9/18/764
CVE ID: CVE-2017-12193 State: PUBLISHED Published: 2017-11-22T18:00:00 Last Updated: 2024-08-05T18:28:16.794Z Vendors: n/a Products: Linux kernel since 3.13 up to 4.14 (not including) Problem Types: CWE-476 Description: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which allows local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11 - https://git
otes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.13.11 - https://github.com/torvalds/linux/commit/ea6789980fdaa610d7eb63602c746bf6ec70cd2b - http://www.securityfocus.com/bid/101678 - https://bugzilla.redhat.com/show_bug.cgi?id=1501215 - https://access.redhat.com/errata/RHSA-2018:0151 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea6789980fdaa610d7eb63602c746bf6ec70cd2b - https://usn.ubuntu.com/3698-1/ - https://usn.ubuntu.com/3698-2/
CVE ID: CVE-2017-12194 State: PUBLISHED Published: 2018-03-14T21:00:00Z Last Updated: 2024-08-05T18:28:16.674Z Vendors: freedesktop.org Products: spice-gtk Problem Types: CWE-121 Description: A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-server, could use this flaw to crash the client or execute arbitrary code with permissions of the user running the client. spice-gtk versions through 0.34 are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201811-20 - https://usn.ubuntu.com/3659-1/ - https://bugzilla.redhat.com/show_bug.cgi?i
https://security.gentoo.org/glsa/201811-20 - https://usn.ubuntu.com/3659-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=1501200 - http://www.securityfocus.com/bid/103413
CVE ID: CVE-2017-12195 State: PUBLISHED Published: 2018-07-27T15:00:00 Last Updated: 2024-08-05T18:28:16.605Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: OpenShift Problem Types: CWE-287 Description: A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices. Additional Analyst Notes: - CVE Program Container: Refer
xternal route, and the data accessed is limited to the indices. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3188 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12195 - https://access.redhat.com/errata/RHSA-2017:3389
CVE ID: CVE-2017-12196 State: PUBLISHED Published: 2018-04-18T01:00:00 Last Updated: 2024-08-05T18:28:16.713Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: unspecified Products: undertow Problem Types: CWE-287 Description: undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0479 -
rver. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:0479 - https://access.redhat.com/errata/RHSA-2018:0481 - https://access.redhat.com/errata/RHSA-2018:2405 - https://access.redhat.com/errata/RHSA-2018:1525 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196 - https://access.redhat.com/errata/RHSA-2018:0480 - https://issues.jboss.org/browse/UNDERTOW-1190 - https://access.redhat.com/errata/RHSA-2018:3768 - https://access.redhat.com/errata/RHSA-2018:0478
CVE ID: CVE-2017-12197 State: PUBLISHED Published: 2018-01-18T21:00:00Z Last Updated: 2024-08-05T18:28:16.597Z Vendors: Red Hat, Inc. Products: libpam4j Problem Types: CWE-863 Description: It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/11/msg00008.html - https://access.redhat.com/errata/RHSA-2017:2904 - https://access.redhat.com/errata/RHSA-2017:2905 - https://access.redhat.co
s://access.redhat.com/errata/RHSA-2017:2904 - https://access.redhat.com/errata/RHSA-2017:2905 - https://access.redhat.com/errata/RHSA-2017:2906 - https://www.debian.org/security/2017/dsa-4025 - https://bugzilla.redhat.com/show_bug.cgi?id=1503103
CVE ID: CVE-2017-12199 State: PUBLISHED Published: 2017-08-02T05:00:00 Last Updated: 2024-08-05T18:28:16.704Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue_update_order list-item, video_update_order video-item, image_update_order list-item, tag_group_update_order list_item, category_products_update_order category-product-item, custom_fields_update_order field-item, categories_update_order category-item, subcategories_update_order subcategory-item, and tags_update_order tag-list-item. Additional Analyst Notes: - CVE Program Container: Refere
e_order subcategory-item, and tags_update_order tag-list-item. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kevins1022/cve/blob/master/wordpress-product-catalog.md
CVE ID: CVE-2017-12200 State: PUBLISHED Published: 2017-08-02T05:00:00 Last Updated: 2024-08-05T18:28:16.646Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kevins1022/cve/blob/master/wordpress-product-catalog.md
CVE ID: CVE-2017-12211 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.649Z Vendors: n/a Products: Cisco IOS and Cisco IOS XE Problem Types: CWE-399 Description: A vulnerability in the IPv6 Simple Network Management Protocol (SNMP) code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote attacker to cause high CPU usage or a reload of the device. The vulnerability is due to IPv6 sub block corruption. An attacker could exploit this vulnerability by polling the affected device IPv6 information. An exploit could allow the attacker to trigger high CPU usage or a reload of the device. Known Affected Releases: Denali-16.3.1. Cisco Bug IDs:
he attacker to trigger high CPU usage or a reload of the device. Known Affected Releases: Denali-16.3.1. Cisco Bug IDs: CSCvb14640. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/100648 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvb14640 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-snmp - http://www.securitytracker.com/id/1039290
CVE ID: CVE-2017-12212 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.681Z Vendors: n/a Products: Cisco Unity Connection Problem Types: CWE-79 Description: A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in th
n attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Known Affected Releases 10.5(2). Cisco Bug IDs: CSCvf25345. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1039277 - http://www.securityfocus.com/bid/100645 - https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf25345 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuc
CVE ID: CVE-2017-12213 State: PUBLISHED Published: 2017-09-07T21:00:00 Last Updated: 2024-08-05T18:28:16.590Z Vendors: n/a Products: Cisco Catalyst 4000 Series Switches Problem Types: CWE-287 Description: A vulnerability in the dynamic access control list (ACL) feature of Cisco IOS XE Software running on Cisco Catalyst 4000 Series Switches could allow an unauthenticated, adjacent attacker to cause dynamic ACL assignment to fail and the port to fail open. This could allow the attacker to pass traffic to the default VLAN of the affected port. The vulnerability is due to an uncaught error condition that may occur during the reassignment of the auth-default-ACL dynamic ACL to a switch port after
caught error condition that may occur during the reassignment of the auth-default-ACL dynamic ACL to a switch port after 802.1x authentication fails. A successful exploit of this issue could allow a physically adjacent attacker to bypass 802.1x authentication and cause the affected port to fail open, allowing the attacker to pass traffic to the default VLAN of the affected switch port. Cisco Bug IDs: CSCvc72751. Additional Analyst Notes: - CVE Program Container: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cat - http://www.securitytracker.com/id/1039284 - http://www.securityfocus.com/bid/100663