deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-6636
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated, remote attacker to view any file on an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to view any file on the system. Cisco Bug IDs: CSCvc99604.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/98526; http://www.securitytracker.com/id/1038515; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp4
CVE: CVE-2017-6637
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to delete any file from the system. Cisco Bug IDs: CSCvc99618.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264, CWE-20
References: http://www.securityfocus.com/bid/98530; http://www.securitytracker.com/id/1038515; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp5
CVE: CVE-2017-6641
Published: 2017-05-22
Description: A vulnerability in the TCP connection handling functionality of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to disable TCP ports and cause a denial of service (DoS) condition on an affected system. The vulnerability is due to a lack of rate-limiting functionality in the TCP Listen application of the affected software. An attacker could exploit this vulnerability by sending a crafted TCP traffic stream in which specific types of TCP packets are flooded to an affected device, for example a TCP packet stream in which the TCP FIN bit is set in all the TCP packets. A successful exploit could allow the attacker to cause certain TCP listening ports on the affected system to stop accepting incoming connections for a period of time or until the affected device is restarted, resulting in a DoS condition. In addition, system resources, such as CPU and memory, could be exhausted during the attack. Cisco Bug IDs: CSCva29806.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-770
References: http://www.securityfocus.com/bid/98532; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-rem1; http://www.securityfocus.com/bid/98532
CVE: CVE-2017-6642
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when responding to HTTP requests that are sent to the web interface of the software. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web interface of the software on an affected system. A successful exploit could allow the attacker to access sensitive information about the software. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvc52856.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/98534; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-rem2; http://www.securityfocus.com/bid/98534
CVE: CVE-2017-6643
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual Directory information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when responding to HTTP requests that are sent to the web interface of the software. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web interface of the software on an affected system. A successful exploit could allow the attacker to access sensitive information about the software. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvc52858.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/98542; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-rem3; http://www.securityfocus.com/bid/98542
CVE: CVE-2017-6644
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when responding to HTTP requests that are sent to the web interface of the software. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web interface of the software on an affected system. A successful exploit could allow the attacker to access sensitive information about the software. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvc52860.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/98539; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-rem4; http://www.securityfocus.com/bid/98539
CVE: CVE-2017-6645
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Virtual Temporary Directory information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when responding to HTTP requests that are sent to the web interface of the software. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web interface of the software on an affected system. A successful exploit could allow the attacker to access sensitive information about the software. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvc52861.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/98537; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-rem5; http://www.securityfocus.com/bid/98537
CVE: CVE-2017-6646
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Order information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when responding to HTTP requests that are sent to the web interface of the software. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web interface of the software on an affected system. A successful exploit could allow the attacker to access sensitive information about the software. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvc52866 CSCvc52868.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/98529; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-rem6; http://www.securityfocus.com/bid/98529
CVE: CVE-2017-6647
Published: 2017-05-22
Description: A vulnerability in the web interface of Cisco Remote Expert Manager Software 11.0.0 could allow an unauthenticated, remote attacker to access sensitive Temporary File information on an affected system. The vulnerability exists because the affected software does not sufficiently protect sensitive data when responding to HTTP requests that are sent to the web interface of the software. An attacker could exploit this vulnerability by sending crafted HTTP requests to the web interface of the software on an affected system. A successful exploit could allow the attacker to access sensitive information about the software. The attacker could use this information to conduct additional reconnaissance attacks. Cisco Bug IDs: CSCvc52875.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/98538; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-rem7; http://www.securityfocus.com/bid/98538
CVE: CVE-2017-6649
Published: 2017-05-22
Description: A vulnerability in the CLI of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into a vulnerable CLI command. An exploit could allow the attacker to read or write arbitrary files at the user's privilege level outside of the user's path. Cisco Bug IDs: CSCvb86787, CSCve60516, CSCve60555.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20, CWE-77
References: http://www.securityfocus.com/bid/98531; http://www.securitytracker.com/id/1038518; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss
CVE: CVE-2017-6650
Published: 2017-05-22
Description: A vulnerability in the Telnet CLI command of Cisco NX-OS System Software 7.1 through 7.3 running on Cisco Nexus Series Switches could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments. An attacker could exploit this vulnerability by injecting crafted command arguments into the Telnet CLI command. An exploit could allow the attacker to read or write arbitrary files at the user's privilege level outside of the user's path. Cisco Bug IDs: CSCvb86771.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20, CWE-77
References: http://www.securityfocus.com/bid/98528; http://www.securitytracker.com/id/1038518; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-nss1
CVE: CVE-2017-6653
Published: 2017-05-22
Description: A vulnerability in the TCP throttling process for the GUI of the Cisco Identity Services Engine (ISE) 2.1(0.474) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device where the ISE GUI may fail to respond to new or established connection requests. The vulnerability is due to insufficient TCP rate limiting protection on the GUI. An attacker could exploit this vulnerability by sending the affected device a high rate of TCP connections to the GUI. An exploit could allow the attacker to cause the GUI to stop responding while the high rate of connections is in progress. Cisco Bug IDs: CSCvc81803.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-770
References: http://www.securityfocus.com/bid/98536; http://www.securitytracker.com/id/1038516; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-ise
CVE: CVE-2017-6654
Published: 2017-05-22
Description: A vulnerability in the web-based management interface of Cisco Unified Communications Manager 10.5 through 11.5 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvc06608.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/98527; http://www.securitytracker.com/id/1038512; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-ucm
CVE: CVE-2017-2494
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797; http://www.securitytracker.com/id/1038484
CVE: CVE-2017-2495
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "Safari" component. It allows remote attackers to cause a denial of service (application crash) via a crafted web site that improperly interacts with the history menu.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/98474; http://www.securitytracker.com/id/1038487; https://support.apple.com/HT207798
CVE: CVE-2017-2496
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98474; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2497
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "iBooks" component. It allows remote attackers to trigger visits to arbitrary URLs via a crafted book.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601
References: http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797; https://support.apple.com/HT207798
CVE: CVE-2017-2498
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. The issue involves the "Security" component. It allows attackers to bypass intended access restrictions via an untrusted certificate.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: http://www.securityfocus.com/bid/98479; http://www.securitytracker.com/id/1038485; https://support.apple.com/HT207798
CVE: CVE-2017-2499
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit Web Inspector" component. It allows attackers to execute arbitrary unsigned code or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98473; http://www.securitytracker.com/id/1038487; https://support.apple.com/HT207798
CVE: CVE-2017-2500
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. Safari before 10.1.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1038487; https://support.apple.com/HT207804; http://www.securitytracker.com/id/1038487
CVE: CVE-2017-2501
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "Kernel" component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: http://www.securityfocus.com/bid/98468; http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797
CVE: CVE-2017-2502
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "CoreAudio" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securityfocus.com/bid/98468; http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797
CVE: CVE-2017-2503
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Intel Graphics Driver" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797; http://www.securitytracker.com/id/1038484
CVE: CVE-2017-2504
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with WebKit Editor commands.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98473; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2505
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98473; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2506
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98474; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2507
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/98468; http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797
CVE: CVE-2017-2508
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with container nodes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98474; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2509
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
CVSS Score: 5.5 (MEDIUM)
References: http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797; https://www.exploit-db.com/exploits/42046/
CVE: CVE-2017-2510
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/98474; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2511
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. Safari before 10.1.1 is affected. The issue involves the "Safari" component. It allows remote attackers to spoof the address bar via a crafted web site.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securitytracker.com/id/1038487; https://support.apple.com/HT207804; http://www.securitytracker.com/id/1038487
CVE: CVE-2017-2512
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the "Sandbox" component. It allows attackers to conduct sandbox-escape attacks or cause a denial of service (memory corruption) via a crafted app.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797; http://www.securitytracker.com/id/1038484
CVE: CVE-2017-2513
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "SQLite" component. A use-after-free vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SQL statement.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/98468; http://www.securitytracker.com/id/1038484; https://support.apple.com/HT207797
CVE: CVE-2017-2514
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98474; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15
CVE: CVE-2017-2515
Published: 2017-05-22
Description: An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/98473; http://www.securitytracker.com/id/1038487; https://security.gentoo.org/glsa/201706-15