deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-12900
Published: 2019-06-19
Description: BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html
CVE: CVE-2019-2729
Published: 2019-06-19
Description: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/155886/Oracle-Weblogic-10.3.6.0.0-Remote-Command-Execution.html; http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2[PII_REDACTED].html; http://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
CVE: CVE-2019-3737
Published: 2019-06-19
Description: Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the affected system by sending a specially crafted request to the Web Interface application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://seclists.org/fulldisclosure/2019/Jun/25; https://seclists.org/fulldisclosure/2019/Jun/25
CVE: CVE-2019-3787
Published: 2019-06-19
Description: Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.
CVSS Score: 8.3 (HIGH)
CWE: CWE-840, CWE-640
References: https://www.cloudfoundry.org/blog/cve-2019-3787; https://www.cloudfoundry.org/blog/cve-2019-3787
CVE: CVE-2019-12901
Published: 2019-06-20
Description: Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security; https://research.loginsoft.com/vulnerability/multiple-vulnerabilities-in-pydio-cells-1-4-1/; https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security
CVE: CVE-2019-12902
Published: 2019-06-20
Description: Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-459
References: https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security; https://research.loginsoft.com/vulnerability/multiple-vulnerabilities-in-pydio-cells-1-4-1/; https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security
CVE: CVE-2019-12903
Published: 2019-06-20
Description: Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security; https://research.loginsoft.com/vulnerability/multiple-vulnerabilities-in-pydio-cells-1-4-1/; https://pydio.com/en/community/releases/pydio-cells/pydio-cells-150-performances-features-security
CVE: CVE-2019-12904
Published: 2019-06-20
Description: In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-668
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html; https://dev.gnupg.org/T4541; https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020
CVE: CVE-2019-1623
Published: 2019-06-20
Description: A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root user. The vulnerability is due to insufficient input validation during the execution of a vulnerable CLI command. An attacker with administrator-level credentials could exploit this vulnerability by injecting crafted arguments during command execution. A successful exploit could allow the attacker to perform arbitrary code execution as root on an affected product.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-78
References: http://www.securityfocus.com/bid/108840; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-cms-codex; http://www.securityfocus.com/bid/108840
CVE: CVE-2019-1624
Published: 2019-06-20
Description: A vulnerability in the vManage web-based UI (Web UI) in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to the device and submitting crafted input to the vManage Web UI. A successful exploit could allow the attacker to execute commands with root privileges.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://www.securityfocus.com/bid/108845; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-sdwan-cmdinj; http://www.securityfocus.com/bid/108845
CVE: CVE-2019-1625
Published: 2019-06-20
Description: A vulnerability in the CLI of Cisco SD-WAN Solution could allow an authenticated, local attacker to elevate lower-level privileges to the root user on an affected device. The vulnerability is due to insufficient authorization enforcement. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. A successful exploit could allow the attacker to make configuration changes to the system as the root user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/108844; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-sdwan-privesca; http://www.securityfocus.com/bid/108844
CVE: CVE-2019-1626
Published: 2019-06-20
Description: A vulnerability in the vManage web-based UI (Web UI) of the Cisco SD-WAN Solution could allow an authenticated, remote attacker to gain elevated privileges on an affected vManage device. The vulnerability is due to a failure to properly authorize certain user actions in the device configuration. An attacker could exploit this vulnerability by logging in to the vManage Web UI and sending crafted HTTP requests to vManage. A successful exploit could allow attackers to gain elevated privileges and make changes to the configuration that they would not normally be authorized to make.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-863
References: http://www.securityfocus.com/bid/108838; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-sdwan-privilescal; http://www.securityfocus.com/bid/108838
CVE: CVE-2019-1627
Published: 2019-06-20
Description: A vulnerability in the Server Utilities of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to gain unauthorized access to sensitive user information from the configuration data that is stored on the affected system. The vulnerability is due to insufficient protection of data in the configuration file. An attacker could exploit this vulnerability by downloading the configuration file. An exploit could allow the attacker to use the sensitive information from the file to elevate privileges.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-312
References: http://www.securityfocus.com/bid/108847; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-infodiscl; http://www.securityfocus.com/bid/108847
CVE: CVE-2019-1628
Published: 2019-06-20
Description: A vulnerability in the web server of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect bounds checking. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. An exploit could allow the attacker to cause a buffer overflow, resulting in a process crash and DoS condition on the device.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-191, CWE-191
References: http://www.securityfocus.com/bid/108851; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-dos; http://www.securityfocus.com/bid/108851
CVE: CVE-2019-1629
Published: 2019-06-20
Description: A vulnerability in the configuration import utility of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to have write access and upload arbitrary data to the filesystem. The vulnerability is due to a failure to delete temporarily uploaded files. An attacker could exploit this vulnerability by crafting a malicious file and uploading it to the affected device. An exploit could allow the attacker to fill up the filesystem or upload malicious scripts.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/108852; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-filewrite; http://www.securityfocus.com/bid/108852
CVE: CVE-2019-1630
Published: 2019-06-20
Description: A vulnerability in the firmware signature checking program of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to cause a buffer overflow, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient checking of an input buffer. An attacker could exploit this vulnerability by passing a crafted file to the affected system. A successful exploit could inhibit an administrator's ability to access the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/108846; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-frmwr-dos; http://www.securityfocus.com/bid/108846
CVE: CVE-2019-1631
Published: 2019-06-20
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow an attacker to view sensitive system data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/108849; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-infodisclos; http://www.securityfocus.com/bid/108849
CVE: CVE-2019-1632
Published: 2019-06-20
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected device. An attacker could exploit this vulnerability by persuading a user to follow a malicious link. A successful exploit could allow the attacker to use a web browser and the privileges of the user to perform arbitrary actions on the affected device.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/108858; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-imc-csrf; http://www.securityfocus.com/bid/108858
CVE: CVE-2019-1843
Published: 2019-06-20
Description: A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit this vulnerability by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to reload the device and causing a DoS condition.
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108864; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rvrouters-dos; http://www.securityfocus.com/bid/108864
CVE: CVE-2019-1848
Published: 2019-06-20
Description: A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, adjacent attacker to bypass authentication and access critical internal services. The vulnerability is due to insufficient access restriction to ports necessary for system operation. An attacker could exploit this vulnerability by connecting an unauthorized network device to the subnet designated for cluster services. A successful exploit could allow an attacker to reach internal services that are not hardened for external access.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-668, CWE-668
References: http://www.securityfocus.com/bid/108837; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-dnac-bypass; http://www.securityfocus.com/bid/108837
CVE: CVE-2019-1869
Published: 2019-06-20
Description: A vulnerability in the internal packet-processing functionality of the Cisco StarOS operating system running on virtual platforms could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error that may occur under specific traffic conditions. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to prevent the targeted service interface from receiving any traffic, which would lead to a DoS condition on the affected interface. The device may have to be manually reloaded to recover from exploitation of this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-824, CWE-824
References: http://www.securityfocus.com/bid/108853; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-staros-asr-dos; http://www.securityfocus.com/bid/108853
CVE: CVE-2019-1874
Published: 2019-06-20
Description: A vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system. The vulnerability is due to insufficient CSRF protection mechanisms on the web-based management interface on an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions with the privilege level of the affected user.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/108861; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-psc-csrf; http://www.securityfocus.com/bid/108861
CVE: CVE-2019-1875
Published: 2019-06-20
Description: A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by adding specific strings to multiple configuration fields. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-20, CWE-79
References: http://www.securityfocus.com/bid/108836; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-psc-xss; http://www.securityfocus.com/bid/108836
CVE: CVE-2019-1876
Published: 2019-06-20
Description: A vulnerability in the HTTPS proxy feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to use the Central Manager as an HTTPS proxy. The vulnerability is due to insufficient authentication of proxy connection requests. An attacker could exploit this vulnerability by sending a malicious HTTPS CONNECT message to the Central Manager. A successful exploit could allow the attacker to access public internet resources that would normally be blocked by corporate policies.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-306, CWE-306
References: http://www.securityfocus.com/bid/108863; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-waas-authbypass; http://www.securityfocus.com/bid/108863
CVE: CVE-2019-1878
Published: 2019-06-20
Description: A vulnerability in the Cisco Discovery Protocol (CDP) implementation for the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to insufficient input validation of received CDP packets. An attacker could exploit this vulnerability by sending crafted CDP packets to an affected device. A successful exploit could allow the attacker to execute arbitrary shell commands or scripts on the targeted device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108883; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-tele-shell-inj; http://www.securityfocus.com/bid/108883
CVE: CVE-2019-1879
Published: 2019-06-20
Description: A vulnerability in the CLI of Cisco Integrated Management Controller (IMC) could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could exploit this vulnerability by authenticating with the administrator password via the CLI of an affected device and submitting crafted input to the affected commands. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108850; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-cimc-cli-cmdinj; http://www.securityfocus.com/bid/108850
CVE: CVE-2019-1897
Published: 2019-06-20
Description: A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to disconnect clients that are connected to the guest network on an affected router. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing the URL for device disconnection and providing the connected device information. A successful exploit could allow the attacker to deny service to specific clients that are connected to the guest network.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-306
References: http://www.securityfocus.com/bid/108848; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-dos; https://www.tenable.com/security/research/tra-2019-29
CVE: CVE-2019-1898
Published: 2019-06-20
Description: A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing the URL for the syslog file. A successful exploit could allow the attacker to access the information contained in the file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-425
References: http://www.securityfocus.com/bid/108865; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-fileaccess; https://www.tenable.com/security/research/tra-2019-29
CVE: CVE-2019-1899
Published: 2019-06-20
Description: A vulnerability in the web interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to acquire the list of devices that are connected to the guest network. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this vulnerability by accessing a specific URI on the web interface of the router.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-425
References: http://www.securityfocus.com/bid/108867; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-rv-infodis; https://www.tenable.com/security/research/tra-2019-29
CVE: CVE-2019-1903
Published: 2019-06-20
Description: A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to access sensitive information or cause a denial of service (DoS) condition. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit this vulnerability by sending malicious requests to a targeted system that contain references within XML entities. An exploit could allow the attacker to retrieve files from the local system, resulting in the disclosure of sensitive information, or cause the application to consume available resources, resulting in a DoS condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/108857; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-csm-xml; http://www.securityfocus.com/bid/108857
CVE: CVE-2019-1905
Published: 2019-06-20
Description: A vulnerability in the GZIP decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass configured content filters on the device. The vulnerability is due to improper validation of GZIP-formatted files. An attacker could exploit this vulnerability by sending a malicious file inside a crafted GZIP-compressed file. A successful exploit could allow the attacker to bypass configured content filters that would normally drop the email.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108856; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190619-esa-bypass; http://www.securityfocus.com/bid/108856