deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: A data modification vulnerability exists in Jenkins Agiletestware Pangolin Connector for TestRail Plugin 2.1 and earlier in GlobalConfig.java that allows attackers with Overall/Read permission to override this plugin's configuration by sending crafted HTTP requests to an unprotected endpoint.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-269
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-995; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-995
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system access to the Jenkins master to obtain the password stored in this plugin's configuration.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1039; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1039
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: A man in the middle vulnerability exists in Jenkins Inedo ProGet Plugin 0.8 and earlier in ProGetApi.java, ProGetConfig.java, ProGetConfiguration.java that allows attackers to impersonate any service that Jenkins connects to.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-933; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-933
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-935; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-935
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-704; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-704
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a resource.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-997; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-997
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-441
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-975
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: A server-side request forgery vulnerability exists in Jenkins Confluence Publisher Plugin 2.0.1 and earlier in ConfluenceSite.java that allows attackers to have Jenkins submit login requests to an attacker-specified Confluence server URL with attacker specified credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-982; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-982
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1016; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1016
CVE: CVE-2[PII_REDACTED]
Published: 2018-08-01
Description: An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://jenkins.io/security/advisory/2018-07-30/#SECURITY-840; https://jenkins.io/security/advisory/2018-07-30/#SECURITY-840
CVE: CVE-2016-8608
Published: 2018-08-01
Description: JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges to create business processes can store scripts in them, which are not properly sanitized before showing to other users, including admins.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://rhn.redhat.com/errata/RHSA-2016-2822.html; http://rhn.redhat.com/errata/RHSA-2016-2823.html; http://www.securityfocus.com/bid/94568
CVE: CVE-2016-8641
Published: 2018-08-01
Description: A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and possibly escalating the privileges with the ownership change.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-59, CWE-59
References: http://www.securityfocus.com/bid/95121; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8641; https://github.com/NagiosEnterprises/nagioscore/commit/f2ed227673d3b2da643eb5cad26b2d87674f28c1.patch
CVE: CVE-2016-8648
Published: 2018-08-01
Description: It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.
CVSS Score: 7.2 (HIGH)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/94513; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648; http://www.securityfocus.com/bid/94513
CVE: CVE-2016-8653
Published: 2018-08-01
Description: It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/94544; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653; http://www.securityfocus.com/bid/94544
CVE: CVE-2016-9581
Published: 2018-08-01
Description: An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.
CVSS Score: 3.3 (LOW)
CWE: CWE-122, CWE-835, CWE-119
References: http://www.securityfocus.com/bid/94822; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9581; https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255
CVE: CVE-2018-10916
Published: 2018-08-01
Description: It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00036.html; http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00010.html; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10916
CVE: CVE-2017-5692
Published: 2018-08-01
Description: Out-of-bounds read condition in older versions of some Intel Graphics Driver for Windows code branches allows local users to perform a denial of service attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104957; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00077.html; http://www.securityfocus.com/bid/104957
CVE: CVE-2018-12466
Published: 2018-08-01
Description: openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-285, CWE-732
References: http://www.securityfocus.com/bid/104958; https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-12466; https://github.com/openSUSE/open-build-service/commit/f57b660f49f830006766a8d4abc3b4af6e178063
CVE: CVE-2018-12467
Published: 2018-08-01
Description: Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-285, CWE-732
References: https://bugzilla.suse.com/show_bug.cgi?id=1100217; https://github.com/openSUSE/open-build-service/commit/f57b660f49f830006766a8d4abc3b4af6e178063; https://bugzilla.suse.com/show_bug.cgi?id=1100217
CVE: CVE-2018-3650
Published: 2018-08-01
Description: Insufficient Input Validation in Bleach module in INTEL Distribution for Python versions prior to IDP 2018 Update 2 allows unprivileged user to bypass URI sanitization via local vector.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00129.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00129.html
CVE: CVE-2018-3662
Published: 2018-08-01
Description: Escalation of privilege in Intel Saffron MemoryBase before version 11.4 potentially allows an authorized user of the Saffron application to execute arbitrary code as root.
CVSS Score: 8.0 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00136.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00136.html
CVE: CVE-2018-3663
Published: 2018-08-01
Description: Escalation of privilege in Intel Saffron MemoryBase before 11.4 allows an authenticated user access to privileged information.
CVSS Score: 5.7 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00136.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00136.html
CVE: CVE-2018-3666
Published: 2018-08-01
Description: Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a non-paged pool overflow.
CVSS Score: 8.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00163.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00163.html
CVE: CVE-2018-3670
Published: 2018-08-01
Description: Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a buffer overflow.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00163.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00163.html
CVE: CVE-2018-3671
Published: 2018-08-01
Description: Escalation of privilege in Intel Saffron admin application before 11.4 allows an authenticated user to access unauthorized information.
CVSS Score: 5.7 (MEDIUM)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00136.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00136.html
CVE: CVE-2018-3672
Published: 2018-08-01
Description: Driver module in Intel Smart Sound Technology before version 9.21.00.3541 potentially allows a local attacker to execute arbitrary code as administrator via a system calls.
CVSS Score: 8.8 (HIGH)
References: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00163.html; https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00163.html
CVE: CVE-2018-3921
Published: 2018-08-01
Description: A memory corruption vulnerability exists in the PSD-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PSD image processed via the application can lead to a stack overflow, overwriting arbitrary data. An attacker can deliver a PSD image to trigger this vulnerability and gain code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0585; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0585
CVE: CVE-2018-3922
Published: 2018-08-01
Description: A memory corruption vulnerability exists in the ANI-parsing functionality of Computerinsel Photoline 20.54. A specially crafted ANI image processed via the application can lead to a stack overflow, overwriting arbitrary data. An attacker can deliver an ANI image to trigger this vulnerability and gain code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0586; https://talosintelligence.com/vulnerability_reports/TALOS-2018-0586
CVE: CVE-2018-3923
Published: 2018-08-01
Description: A memory corruption vulnerability exists in the PCX-parsing functionality of Computerinsel Photoline 20.54. A specially crafted PCX image processed via the application can lead to an out-of-bounds write, overwriting arbitrary data. An attacker can deliver a PCX image to trigger this vulnerability and gain code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0587; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0587
CVE: CVE-2016-8651
Published: 2018-08-01
Description: An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
CVSS Score: 3.1 (LOW)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/94935; https://access.redhat.com/errata/RHSA-2016:2915; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651
CVE: CVE-2016-8654
Published: 2018-08-01
Description: A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-119
References: http://www.securityfocus.com/bid/94583; https://access.redhat.com/errata/RHSA-2017:1208; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8654
CVE: CVE-2016-9572
Published: 2018-08-01
Description: A NULL pointer dereference flaw was found in the way openjpeg 2.1.2 decoded certain input images. Due to a logic error in the code responsible for decoding the input image, an application using openjpeg to process image data could crash when processing a crafted image.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.securityfocus.com/bid/109233; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9572; https://github.com/szukw000/openjpeg/commit/7b28bd2b723df6be09fe7791eba33147c1c47d0d
CVE: CVE-2016-9579
Published: 2018-08-01
Description: A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a bucket. A remote unauthenticated attacker could use this flaw to cause denial of service by sending a specially-crafted cross-origin HTTP request. Ceph branches 1.3.x and 2.x are affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://rhn.redhat.com/errata/RHSA-2016-2954.html; http://rhn.redhat.com/errata/RHSA-2016-2956.html; http://rhn.redhat.com/errata/RHSA-2016-2994.html
CVE: CVE-2016-9580
Published: 2018-08-01
Description: An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.
CVSS Score: 3.3 (LOW)
CWE: CWE-122, CWE-190, CWE-190
References: http://www.securityfocus.com/bid/94822; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9580; https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255
CVE: CVE-2016-8609
Published: 2018-08-01
Description: It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
CVSS Score: 3.7 (LOW)
CWE: CWE-384, CWE-287
References: http://rhn.redhat.com/errata/RHSA-2016-2945.html; http://www.securityfocus.com/bid/95070; http://www.securitytracker.com/id/1037460
CVE: CVE-2016-9583
Published: 2018-08-01
Description: An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-190, CWE-125
References: http://www.securityfocus.com/bid/94925; https://access.redhat.com/errata/RHSA-2017:1208; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9583
CVE: CVE-2018-10894
Published: 2018-08-01
Description: It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-345, CWE-295
References: https://access.redhat.com/errata/RHSA-2018:3592; https://access.redhat.com/errata/RHSA-2018:3593; https://access.redhat.com/errata/RHSA-2018:3595
CVE: CVE-2018-10896
Published: 2018-08-01
Description: The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to impersonate one another or conduct man-in-the-middle attacks.
CVSS Score: 7.1 (HIGH)
CWE: CWE-321
References: https://bugs.launchpad.net/cloud-init/+bug/1781094; https://bugzilla.redhat.com/show_bug.cgi?id=1574338; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10896
CVE: CVE-2018-10897
Published: 2018-08-01
Description: A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. If an attacker controls a repository, they may be able to copy files outside of the destination directory on the targeted system via path traversal. If reposync is running with heightened privileges on a targeted system, this flaw could potentially result in system compromise via the overwriting of critical system files. Version 1.1.31 and older are believed to be affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-59, CWE-22
References: http://www.securitytracker.com/id/1041594; https://access.redhat.com/errata/RHSA-2018:2284; https://access.redhat.com/errata/RHSA-2018:2285
CVE: CVE-2018-1595
Published: 2018-08-01
Description: IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622.
CVSS Score: 8.8 (HIGH)
References: http://www.securityfocus.com/bid/104956; https://exchange.xforce.ibmcloud.com/vulnerabilities/143622; https://www.ibm.com/support/docview.wss?uid=isg3T1027819
CVE: CVE-2016-8640
Published: 2018-08-01
Description: A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: http://seclists.org/oss-sec/2016/q4/406; http://www.securityfocus.com/bid/94302; https://github.com/geopython/pycsw/pull/474/files
CVE: CVE-2018-10618
Published: 2018-08-01
Description: Davolink DVW-3200N all version prior to Version 1.00.06. The device generates a weak password hash that is easily cracked, allowing a remote attacker to obtain the password for the device.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-916, CWE-916
References: http://www.securityfocus.com/bid/104940; https://ics-cert.us-cert.gov/advisories/ICSA-18-212-01; https://www.exploit-db.com/exploits/45076/
CVE: CVE-2018-8034
Published: 2018-08-01
Description: The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295, CWE-295
References: http://mail-archives.us.apache.org/mod_mbox/www-announce/201807.mbox/%3C[PII_REDACTED]1057.GA70283%40minotaur.apache.org%3E; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/104895
CVE: CVE-2018-14777
Published: 2018-08-01
Description: An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and /index.php?do=addnews URIs) to send a malicious script to unsuspecting Admins or users.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://cxsecurity.com/issue/WLB[PII_REDACTED]
CVE: CVE-2018-3847
Published: 2018-08-01
Description: Multiple exploitable buffer overflow vulnerabilities exist in image parsing functionality of the CFITSIO library version 3.42. Specially crafted images parsed via the library, can cause a stack-based buffer overflow overwriting arbitrary data. An attacker can deliver an FIT image to trigger this vulnerability and potentially gain code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://security.gentoo.org/glsa/202101-24; https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0530; https://security.gentoo.org/glsa/202101-24
CVE: CVE-2018-0391
Published: 2018-08-01
Description: A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this vulnerability by changing a specific administrator account password. A successful exploit could allow the attacker to cause the affected device to become inoperable, resulting in a denial of service (DoS) condition. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvd86586.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: http://www.securityfocus.com/bid/104942; http://www.securitytracker.com/id/1041409; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-pcp-dos