deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0093
Published: 2018-01-18
Description: A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf37392.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/102735; http://www.securitytracker.com/id/1040250; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wsa1
CVE: CVE-2018-0094
Published: 2018-01-18
Description: A vulnerability in IPv6 ingress packet processing for Cisco UCS Central Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to high CPU utilization on the targeted device. The vulnerability is due to insufficient rate limiting protection for IPv6 ingress traffic. An attacker could exploit this vulnerability by sending the affected device a high rate of IPv6 packets. Successful exploitation could allow the attacker to cause a DoS condition due to CPU and resource constraints. Cisco Bug IDs: CSCuv34544.
CVSS Score: 7.5 (HIGH)
CWE: CWE-693, CWE-400
References: http://www.securityfocus.com/bid/102787; http://www.securitytracker.com/id/1040249; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-ucs
CVE: CVE-2018-0095
Published: 2018-01-18
Description: A vulnerability in the administrative shell of Cisco AsyncOS on Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA) could allow an authenticated, local attacker to escalate their privilege level and gain root access. The attacker has to have a valid user credential with at least a privilege level of a guest user. The vulnerability is due to an incorrect networking configuration at the administrative shell CLI. An attacker could exploit this vulnerability by authenticating to the targeted device and issuing a set of crafted, malicious commands at the administrative shell. An exploit could allow the attacker to gain root access on the device. Cisco Bug IDs: CSCvb34303, CSCvb35726.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/102729; http://www.securitytracker.com/id/1040221; http://www.securitytracker.com/id/1040222
CVE: CVE-2018-0096
Published: 2018-01-18
Description: A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to perform a privilege escalation in which one virtual domain user can view and modify another virtual domain configuration. The vulnerability is due to a failure to properly enforce RBAC for virtual domains. An attacker could exploit this vulnerability by sending an authenticated, crafted HTTP request to a targeted application. An exploit could allow the attacker to bypass RBAC policies on the targeted system to modify a virtual domain and access resources that are not normally accessible. Cisco Bug IDs: CSCvg36875.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-264, CWE-863
References: http://www.securityfocus.com/bid/102727; http://www.securitytracker.com/id/1040242; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-cpi
CVE: CVE-2018-0097
Published: 2018-01-18
Description: A vulnerability in the web interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect. The vulnerability is due to improper input validation of the parameters in the HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that could cause the web application to redirect the request to a specific malicious URL. This vulnerability is known as an open redirect attack and is used in phishing attacks to get users to visit malicious sites without their knowledge. Cisco Bug IDs: CSCve37646.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://www.securityfocus.com/bid/102724; http://www.securitytracker.com/id/1040243; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-prime-infrastructure
CVE: CVE-2018-0098
Published: 2018-01-18
Description: A vulnerability in the web-based management interface of Cisco WAP150 Wireless-AC/N Dual Radio Access Point with Power over Ethernet (PoE) and WAP361 Wireless-AC/N Dual Radio Wall Plate Access Point with PoE could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve57076.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/102763; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wap; http://www.securityfocus.com/bid/102763
CVE: CVE-2018-0099
Published: 2018-01-18
Description: A vulnerability in the web management GUI of the Cisco D9800 Network Transport Receiver could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of GUI command arguments. An attacker could exploit this vulnerability by injecting crafted arguments into a vulnerable GUI command. An exploit could allow the attacker to execute commands on the underlying BusyBox operating system. These commands are run at the privilege level of the authenticated user. The attacker needs valid device credentials for this attack. Cisco Bug IDs: CSCvg74691.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/102731; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-ntr; http://www.securityfocus.com/bid/102731
CVE: CVE-2018-0100
Published: 2018-01-18
Description: A vulnerability in the Profile Editor of the Cisco AnyConnect Secure Mobility Client could allow an unauthenticated, local attacker to have read and write access to information stored in the affected system. The vulnerability is due to improper handling of the XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by injecting a crafted XML file with malicious entries, which could allow the attacker to read and write files. Cisco Bug IDs: CSCvg19341.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/102738; http://www.securitytracker.com/id/1040246; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-acpe
CVE: CVE-2018-0102
Published: 2018-01-18
Description: A vulnerability in the Pong tool of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software attempts to free the same area of memory twice. An attacker could exploit this vulnerability by sending a pong request to an affected device from a location on the network that causes the pong reply packet to egress both a FabricPath port and a non-FabricPath port. An exploit could allow the attacker to cause a dual or quad supervisor virtual port-channel (vPC) to reload. This vulnerability affects the following products when running Cisco NX-OS Software Release 7.2(1)D(1), 7.2(2)D1(1), or 7.2(2)D1(2) with both the Pong and FabricPath features enabled and the FabricPath port is actively monitored via a SPAN session: Cisco Nexus 7000 Series Switches and Cisco Nexus 7700 Series Switches. Cisco Bug IDs: CSCuv98660.
CVSS Score: 7.4 (HIGH)
CWE: CWE-399, CWE-415
References: http://www.securityfocus.com/bid/102728; http://www.securitytracker.com/id/1040219; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-nx-os
CVE: CVE-2018-0105
Published: 2018-01-18
Description: A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could exploit this vulnerability by browsing to a specific URL. An exploit could allow the attacker to view data library information. Cisco Bug IDs: CSCvf20269.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-425
References: http://www.securityfocus.com/bid/102725; http://www.securitytracker.com/id/1040245; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-ucm
CVE: CVE-2018-0106
Published: 2018-01-18
Description: A vulnerability in the ConfD server of the Cisco Elastic Services Controller (ESC) could allow an unauthenticated, local attacker to access sensitive information on a targeted system. The vulnerability is due to insufficient security restrictions. An attacker could exploit this vulnerability by accessing unauthorized information within the ConfD directory and file structure. Successful exploitation could allow the attacker to view sensitive information. Cisco Bug IDs: CSCvg00221.
CVSS Score: 3.3 (LOW)
CWE: CWE-200, CWE-552
References: http://www.securityfocus.com/bid/102757; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-esc; http://www.securityfocus.com/bid/102757
CVE: CVE-2018-0107
Published: 2018-01-18
Description: A vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an affected device. The vulnerability is due to a lack of cross-site request forgery (CSRF) protection. An attacker could exploit this vulnerability by tricking the user of a web application into executing an adverse action. Cisco Bug IDs: CSCvg30313.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: http://www.securityfocus.com/bid/102719; http://www.securitytracker.com/id/1040244; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-psc
CVE: CVE-2018-0108
Published: 2018-01-18
Description: A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611, CWE-611
References: http://www.securityfocus.com/bid/102720; http://www.securitytracker.com/id/1040238; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms
CVE: CVE-2018-0109
Published: 2018-01-18
Description: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to obtain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server that could allow an attacker who is authenticated as root to gain shared secrets. An attacker could exploit the vulnerability by accessing the root account and viewing sensitive information. Successful exploitation could allow the attacker to discover sensitive information about the application. Cisco Bug IDs: CSCvg42664.
CVSS Score: 2.7 (LOW)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/102722; http://www.securitytracker.com/id/1040235; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms1
CVE: CVE-2018-0110
Published: 2018-01-18
Description: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to access the remote support account even after it has been disabled via the web application. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server, which would not disable access to specifically configured user accounts, even after access had been disabled in the web application. An attacker could exploit this vulnerability by connecting to the remote support account, even after it had been disabled at the web application level. An exploit could allow the attacker to modify server configuration and gain access to customer data. Cisco Bug IDs: CSCvg46741.
CVSS Score: 8.1 (HIGH)
CWE: CWE-254, CWE-863
References: http://www.securityfocus.com/bid/102773; http://www.securitytracker.com/id/1040236; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms2
CVE: CVE-2018-0111
Published: 2018-01-18
Description: A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the application. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to a design flaw in Cisco WebEx Meetings Server, which could include internal network information that should be restricted. An attacker could exploit the vulnerability by utilizing available resources to study the customer network. An exploit could allow the attacker to discover sensitive data about the application. Cisco Bug IDs: CSCvg46806.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/102723; http://www.securitytracker.com/id/1040237; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms3
CVE: CVE-2018-0115
Published: 2018-01-18
Description: A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series routers could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected host operating system. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by injecting malicious command arguments into a vulnerable CLI command. A successful exploit could allow the attacker to execute arbitrary commands with root privileges. To exploit this vulnerability, the attacker would need to authenticate to the affected system by using valid administrator credentials. Cisco Bug IDs: CSCvf93332.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/102788; http://www.securitytracker.com/id/1040239; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-staros
CVE: CVE-2018-5766
Published: 2018-01-18
Description: In Libav through 12.2, there is an invalid memcpy in the av_packet_ref function of libavcodec/avpacket.c. Remote attackers could leverage this vulnerability to cause a denial of service (segmentation fault) via a crafted avi file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/102793; https://bugzilla.libav.org/show_bug.cgi?id=1112; https://lists.debian.org/debian-lts-announce/2019/09/msg00000.html
CVE: CVE-2018-5772
Published: 2018-01-18
Description: In Exiv2 0.26, there is a segmentation fault caused by uncontrolled recursion in the Exiv2::Image::printIFDStructure function in the image.cpp file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted tif file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://www.securityfocus.com/bid/102789; https://github.com/Exiv2/exiv2/issues/216; https://security.gentoo.org/glsa/201811-14
CVE: CVE-2014-2017
Published: 2018-01-18
Description: CRLF injection vulnerability in OXID eShop Professional Edition before 4.7.11 and 4.8.x before 4.8.4, Enterprise Edition before 5.0.11 and 5.1.x before 5.1.4, and Community Edition before 4.7.11 and 4.8.x before 4.8.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-93
References: https://bugs.oxid-esales.com/view.php?id=5635; https://oxidforge.org/en/security-bulletin-2014-002.html; https://bugs.oxid-esales.com/view.php?id=5635
CVE: CVE-2017-15869
Published: 2018-01-18
Description: Cross-site scripting (XSS) vulnerability in knowledgebase.php in LiveZilla before 7.0.8.9 allows remote attackers to inject arbitrary web script or HTML via the search-for parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/archive/1/541688/100/0/threaded; https://www.livezilla.net/changelog/en/; https://www.pallas.com/advisories/cve-2017-15869-livezilla-xss-knowledgebase
CVE: CVE-2017-18033
Published: 2018-01-18
Description: The Jira-importers-plugin in Atlassian Jira before version 7.6.1 allows remote attackers to create new projects and abort an executing external system import via various Cross-site request forgery (CSRF) vulnerabilities.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://www.securityfocus.com/bid/102744; https://jira.atlassian.com/browse/JRASERVER-66643; http://www.securityfocus.com/bid/102744
CVE: CVE-2017-15520
Published: 2018-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-15521
Published: 2018-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-15522
Published: 2018-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-15523
Published: 2018-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-17838
Published: 2018-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2017-17839
Published: 2018-01-18
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2017. Notes: none
CVE: CVE-2016-6814
Published: 2018-01-18
Description: When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502
References: http://mail-archives.apache.org/mod_mbox/www-announce/201701.mbox/%3CCADRx3PMZ2hBCGDTY35zYXFGaDnjAs0tc5-upaVs6QN2sYUejyA%40mail.gmail.com%3E; http://rhn.redhat.com/errata/RHSA-2017-0272.html; http://www.oracle.com/technetwork/security-advisory/cpuapr2[PII_REDACTED].html
CVE: CVE-2017-16863
Published: 2018-01-18
Description: The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a project or filter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102732; https://jira.atlassian.com/browse/JRASERVER-66623; http://www.securityfocus.com/bid/102732
CVE: CVE-2017-12729
Published: 2018-01-18
Description: A SQL Injection issue was discovered in Moxa SoftCMS Live Viewer through 1.6. An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability has been identified. Attackers can exploit this vulnerability to access SoftCMS without knowing the user's password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://ics-cert.us-cert.gov/advisories/ICSA-17-243-05; https://ics-cert.us-cert.gov/advisories/ICSA-17-243-05
CVE: CVE-2017-5170
Published: 2018-01-18
Description: An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path element (DLL Hijacking) vulnerability has been identified. To exploit this vulnerability, an attacker could rename a malicious DLL to meet the criteria of the application, and the application would not verify that the DLL is correct. The attacker needs to have administrative access to the default install location in order to plant the insecure DLL. Once loaded by the application, the DLL could run malicious code at the privilege level of the application.
CVSS Score: 7.2 (HIGH)
CWE: CWE-427, CWE-427
References: http://www.securityfocus.com/bid/100208; https://ics-cert.us-cert.gov/advisories/ICSA-17-220-02; http://www.securityfocus.com/bid/100208
CVE: CVE-2017-3158
Published: 2018-01-18
Description: A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://lists.apache.org/thread.html/b218d36bfdaf655d27382daec4dcd02ec717631f4aee8b7e4300ad65%40%3Cuser.guacamole.apache.org%3E; https://lists.apache.org/thread.html/b218d36bfdaf655d27382daec4dcd02ec717631f4aee8b7e4300ad65%40%3Cuser.guacamole.apache.org%3E
CVE: CVE-2017-12197
Published: 2018-01-18
Description: It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863, CWE-20
References: https://access.redhat.com/errata/RHSA-2017:2904; https://access.redhat.com/errata/RHSA-2017:2905; https://access.redhat.com/errata/RHSA-2017:2906
CVE: CVE-2018-5773
Published: 2018-01-18
Description: An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/trentm/python-markdown2/issues/285; https://github.com/trentm/python-markdown2/issues/285