deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1610
Published: 2019-03-11
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Nexus 3500 Platform Switches and Nexus 3000 Series Switches software versions prior to 7.0(3)I7(4) are affected.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/107338; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-cmdinj-1610; http://www.securityfocus.com/bid/107338
CVE: CVE-2019-1611
Published: 2019-03-11
Description: A vulnerability in the CLI of Cisco NX-OS Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Firepower 4100 Series Next-Generation Firewalls are affected running software versions prior to 2.2.2.91, 2.3.1.110, and 2.4.1.222. Firepower 9300 Security Appliance are affected running software versions prior to 2.2.2.91, 2.3.1.110, and 2.4.1.222. MDS 9000 Series Multilayer Switches are affected running software versions prior to 6.2(25) and 8.3(1). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(5). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(5). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected running software versions prior to 7.1(5)N1(1b) and 7.3(4)N1(1). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 6.2(22), 7.3(3)D1(1), 8.2(3). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(5). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/107381; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-cmdinj-1611; http://www.securityfocus.com/bid/107381
CVE: CVE-2019-1612
Published: 2019-03-11
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(4). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Stand are affected running software versions prior to 7.0(3)F3(5).
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-77, CWE-78
References: http://www.securityfocus.com/bid/107388; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-cmdinj-1612; http://www.securityfocus.com/bid/107388
CVE: CVE-2019-1613
Published: 2019-03-11
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability. MDS 9000 Series Multilayer Switches are affected running software versions prior to 6.2(27) and 8.2(3). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(6). Nexus 3500 Platform Switches are affected running software versions prior to 6.0(2)A8(11) and 7.0(3)I7(6). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9), 7.0(3)I7(6). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 6.2(22) and 8.2(3).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/107392; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-cmdinj-1613; http://www.securityfocus.com/bid/107392
CVE: CVE-2019-1614
Published: 2019-03-11
Description: A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. The vulnerability is due to incorrect input validation of user-supplied data by the NX-API subsystem. An attacker could exploit this vulnerability by sending malicious HTTP or HTTPS packets to the management interface of an affected system that has the NX-API feature enabled. A successful exploit could allow the attacker to perform a command-injection attack and execute arbitrary commands with root privileges. Note: NX-API is disabled by default. MDS 9000 Series Multilayer Switches are affected running software versions prior to 8.1(1b) and 8.2(3). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected running software versions prior to 7.3(4)N1(1). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 7000 and 7700 Series Switches are affected running software versions prior to 7.3(3)D1(1) and 8.2(3).
CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-78
References: http://www.securityfocus.com/bid/107339; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-NXAPI-cmdinj; http://www.securityfocus.com/bid/107339
CVE: CVE-2019-1615
Published: 2019-03-11
Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability is due to improper verification of digital signatures for software images. An attacker could exploit this vulnerability by loading an unsigned software image on an affected device. A successful exploit could allow the attacker to boot a malicious software image. Note: The fix for this vulnerability requires a BIOS upgrade as part of the software upgrade. For additional information, see the Details section of this advisory. Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I7(5). Nexus 9000 Series Fabric Switches in ACI Mode are affected running software versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5).
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/107397; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-sig-verif; http://www.securityfocus.com/bid/107397
CVE: CVE-2019-1616
Published: 2019-03-11
Description: A vulnerability in the Cisco Fabric Services component of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a buffer overflow, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient validation of Cisco Fabric Services packets. An attacker could exploit this vulnerability by sending a crafted Cisco Fabric Services packet to an affected device. A successful exploit could allow the attacker to cause a buffer overflow, resulting in process crashes and a DoS condition on the device. MDS 9000 Series Multilayer Switches are affected running software versions prior to 6.2(25), 8.1(1b), 8.3(1). Nexus 3000 Series Switches are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 3500 Platform Switches are affected running software versions prior to 6.0(2)A8(10) and 7.0(3)I7(4). Nexus 3600 Platform Switches are affected running software versions prior to 7.0(3)F3(5) Nexus 7000 and 7700 Series Switches are affected running software versions prior to 6.2(22) and 8.2(3). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I4(9) and 7.0(3)I7(4). Nexus 9500 R-Series Line Cards and Fabric Modules are affected running software versions prior to 7.0(3)F3(5). UCS 6200, 6300, and 6400 Fabric Interconnects are affected running software versions prior to 3.2(3j) and 4.0(2a).
CVSS Score: 8.6 (HIGH)
CWE: CWE-20, CWE-119
References: http://www.securityfocus.com/bid/107395; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-fabric-dos; http://www.securityfocus.com/bid/107395
CVE: CVE-2019-1617
Published: 2019-03-11
Description: A vulnerability in the Fibre Channel over Ethernet (FCoE) N-port Virtualization (NPV) protocol implementation in Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to an incorrect processing of FCoE packets when the fcoe-npv feature is uninstalled. An attacker could exploit this vulnerability by sending a stream of FCoE frames from an adjacent host to an affected device. An exploit could allow the attacker to cause packet amplification to occur, resulting in the saturation of interfaces and a DoS condition. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running software versions prior to 7.0(3)I7(5) and 9.2(2).
CVSS Score: 7.4 (HIGH)
CWE: CWE-913, CWE-913
References: http://www.securityfocus.com/bid/107336; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nxos-npv-dos; http://www.securityfocus.com/bid/107336
CVE: CVE-2019-1618
Published: 2019-03-11
Description: A vulnerability in the Tetration Analytics agent for Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker to execute arbitrary code as root. The vulnerability is due to an incorrect permissions setting. An attacker could exploit this vulnerability by replacing valid agent files with malicious code. A successful exploit could result in the execution of code supplied by the attacker. Nexus 9000 Series Switches in Standalone NX-OS Mode are affected running versions prior to 7.0(3)I7(5).
CVSS Score: 7.8 (HIGH)
CWE: CWE-275, CWE-732
References: http://www.securityfocus.com/bid/107322; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-tetra-ace; http://www.securityfocus.com/bid/107322
CVE: CVE-2019-1690
Published: 2019-03-11
Description: A vulnerability in the management interface of Cisco Application Policy Infrastructure Controller (APIC) software could allow an unauthenticated, adjacent attacker to gain unauthorized access on an affected device. The vulnerability is due to a lack of proper access control mechanisms for IPv6 link-local connectivity imposed on the management interface of an affected device. An attacker on the same physical network could exploit this vulnerability by attempting to connect to the IPv6 link-local address on the affected device. A successful exploit could allow the attacker to bypass default access control restrictions on an affected device. Cisco Application Policy Infrastructure Controller (APIC) devices running versions prior to 4.2(0.21c) are affected.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284
References: http://www.securityfocus.com/bid/107317; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-apic-ipv6; http://www.securityfocus.com/bid/107317
CVE: CVE-2019-1702
Published: 2019-03-11
Description: Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerabilities are due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit these vulnerabilities either by injecting malicious code in a chat window or by sending a crafted link to a user of the interface. In both cases, the attacker must persuade the user to click the crafted link or open the chat window that contains the attacker's code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. Version 11.6(1) is affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/107314; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-chatmail-xss; http://www.securityfocus.com/bid/107314
CVE: CVE-2019-1707
Published: 2019-03-11
Description: A vulnerability in the web-based management interface of Cisco DNA Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco DNA Center versions prior to 1.2.5 are affected.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/107315; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-dna-xss; http://www.securityfocus.com/bid/107315
CVE: CVE-2018-4057
Published: 2019-03-11
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2018-1890
Published: 2019-03-11
Description: IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-427
References: http://www.securityfocus.com/bid/107448; https://exchange.xforce.ibmcloud.com/vulnerabilities/152081; https://www.ibm.com/support/docview.wss?uid=ibm10873042
CVE: CVE-2018-1902
Published: 2019-03-11
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. IBM X-Force ID: 152531.
CVSS Score: 3.1 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/107383; https://exchange.xforce.ibmcloud.com/vulnerabilities/152531; https://www.ibm.com/support/docview.wss?uid=ibm10795115
CVE: CVE-2018-1922
Published: 2019-03-11
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152858.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107398; https://exchange.xforce.ibmcloud.com/vulnerabilities/152858; https://www.ibm.com/support/docview.wss?uid=ibm10740413
CVE: CVE-2018-1923
Published: 2019-03-11
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152859.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107398; https://exchange.xforce.ibmcloud.com/vulnerabilities/152859; https://www.ibm.com/support/docview.wss?uid=ibm10740413
CVE: CVE-2018-1974
Published: 2019-03-11
Description: IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. IBM X-Force ID: 153915.
CVSS Score: 7.5 (HIGH)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/153915; https://www.ibm.com/support/docview.wss?uid=ibm10792043; https://exchange.xforce.ibmcloud.com/vulnerabilities/153915
CVE: CVE-2018-1978
Published: 2019-03-11
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154069.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107398; https://exchange.xforce.ibmcloud.com/vulnerabilities/154069; https://www.ibm.com/support/docview.wss?uid=ibm10740413
CVE: CVE-2018-1980
Published: 2019-03-11
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154078.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/107398; https://exchange.xforce.ibmcloud.com/vulnerabilities/154078; https://www.ibm.com/support/docview.wss?uid=ibm10740413
CVE: CVE-2018-1998
Published: 2019-03-11
Description: IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix for CVE-2018-1792. IBM X-ForceID: 154887.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/154887; https://www.ibm.com/support/docview.wss?uid=ibm10870488; https://exchange.xforce.ibmcloud.com/vulnerabilities/154887
CVE: CVE-2018-2009
Published: 2019-03-11
Description: IBM API Connect v2018.1 and 2018.4.1 is affected by an information disclosure vulnerability in the consumer API. Any registered user can obtain a list of all other users in all other orgs, including email id/names, etc. IBM X-Force ID: 155148.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/107396; https://exchange.xforce.ibmcloud.com/vulnerabilities/155148; https://www.ibm.com/support/docview.wss?uid=ibm10794327
CVE: CVE-2019-4015
Published: 2019-03-11
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 155893.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/107398; https://exchange.xforce.ibmcloud.com/vulnerabilities/155893; https://www.ibm.com/support/docview.wss?uid=ibm10740413
CVE: CVE-2019-4016
Published: 2019-03-11
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 155894.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/107398; https://exchange.xforce.ibmcloud.com/vulnerabilities/155894; https://www.ibm.com/support/docview.wss?uid=ibm10740413
CVE: CVE-2019-9704
Published: 2019-03-12
Description: Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (daemon crash) via a large crontab file because the calloc return value is not checked.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-252, CWE-476
References: http://www.securityfocus.com/bid/107373; https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
CVE: CVE-2019-9705
Published: 2019-03-12
Description: Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (memory consumption) via a large crontab file because an unlimited number of lines is accepted.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-770
References: http://www.securityfocus.com/bid/107378; https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
CVE: CVE-2019-9706
Published: 2019-03-12
Description: Vixie Cron before the 3.0pl1-133 Debian package allows local users to cause a denial of service (use-after-free and daemon crash) because of a force_rescan_user error.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809167; https://lists.debian.org/debian-lts-announce/2019/03/msg00025.html; https://lists.debian.org/debian-lts-announce/2021/10/msg00029.html
CVE: CVE-2019-9710
Published: 2019-03-12
Description: An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests.
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://github.com/marshmallow-code/webargs/issues/371; https://webargs.readthedocs.io/en/latest/changelog.html; https://github.com/marshmallow-code/webargs/issues/371
CVE: CVE-2019-9644
Published: 2019-03-12
Description: An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/jupyter/notebook/compare/f3f00df...05aa4b2; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO/