deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-0676
Published: 2019-03-05
Description: An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/106886; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676; http://www.securityfocus.com/bid/106886
CVE: CVE-2019-0686
Published: 2019-03-05
Description: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.
CVSS Score: 7.4 (HIGH)
References: http://www.securityfocus.com/bid/106937; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0686; http://www.securityfocus.com/bid/106937
CVE: CVE-2019-0724
Published: 2019-03-05
Description: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0686.
CVSS Score: 8.1 (HIGH)
References: http://www.securityfocus.com/bid/106906; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0724; http://www.securityfocus.com/bid/106906
CVE: CVE-2019-0728
Published: 2019-03-05
Description: A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project, aka 'Visual Studio Code Remote Code Execution Vulnerability'.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2019/Apr/38; http://www.openwall.com/lists/oss-security/2019/04/30/4; http://www.securityfocus.com/bid/106913
CVE: CVE-2019-0729
Published: 2019-03-05
Description: An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-330
References: http://www.securityfocus.com/bid/106966; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729; http://www.securityfocus.com/bid/106966
CVE: CVE-2019-0741
Published: 2019-03-05
Description: An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532
References: http://www.securityfocus.com/bid/106971; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0741; http://www.securityfocus.com/bid/106971
CVE: CVE-2019-0742
Published: 2019-03-05
Description: A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0743.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106967; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0742; http://www.securityfocus.com/bid/106967
CVE: CVE-2019-0743
Published: 2019-03-05
Description: A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique from CVE-2019-0742.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/106970; https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0743; http://www.securityfocus.com/bid/106970
CVE: CVE-2019-8336
Published: 2019-03-05
Description: HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.
CVSS Score: 8.1 (HIGH)
References: https://github.com/hashicorp/consul/issues/5423; https://github.com/hashicorp/consul/issues/5423
CVE: CVE-2019-9555
Published: 2019-03-05
Description: Sagemcom F@st 5260 routers using firmware version 0.4.39, in WPA mode, default to using a PSK that is generated from a 2-part wordlist of known values and a nonce with insufficient entropy. The number of possible PSKs is about 1.78 billion, which is too small.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-331
References: https://seclists.org/fulldisclosure/2019/Mar/12; https://seclists.org/fulldisclosure/2019/Mar/12
CVE: CVE-2019-9578
Published: 2019-03-05
Description: In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-908
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00012.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00018.html; https://blog.inhq.net/posts/yubico-libu2f-host-vuln-part2/
CVE: CVE-2019-9581
Published: 2019-03-06
Description: phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/165263/Booked-Scheduler-2.7.5-Shell-Upload.html; https://pentest.com.tr/exploits/Booked-2-7-5-Remote-Command-Execution-Metasploit.html; https://sourceforge.net/p/phpscheduleit/source/ci/c5a86a279d888bd4362e4b4f61acedc054f99c39/
CVE: CVE-2019-9587
Published: 2019-03-06
Description: There is a stack consumption issue in md5Round1() located in Decrypt.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to Catalog::countPageTree.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41263; https://research.loginsoft.com/bugs/stack-based-buffer-overflow-vulnerability-in-function-md5round1-xpdf-4-01/; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41263
CVE: CVE-2019-9588
Published: 2019-03-06
Description: There is an Invalid memory access in gAtomicIncrement() located at GMutex.h in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41261; https://research.loginsoft.com/bugs/invalid-memory-access-in-gatomiccounter-gatomicincrement-xpdf-4-01/; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41261
CVE: CVE-2019-9589
Published: 2019-03-06
Description: There is a NULL pointer dereference vulnerability in PSOutputDev::setupResources() located in PSOutputDev.cc in Xpdf 4.01. It can be triggered by sending a crafted pdf file to (for example) the pdftops binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41262; https://research.loginsoft.com/bugs/null-pointer-dereference-vulnerability-in-function-psoutputdevsetupresources-xpdf-4-01/; https://forum.xpdfreader.com/viewtopic.php?f=3&t=41262
CVE: CVE-2019-3824
Published: 2019-03-06
Description: A flaw was found in the way an LDAP search expression could crash the shared LDAP server process of a samba AD DC in samba before version 4.10. An authenticated user, having read permissions on the LDAP server, could use this flaw to cause denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00035.html; http://www.securityfocus.com/bid/107347; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3824
CVE: CVE-2019-9590
Published: 2019-03-06
Description: An issue was discovered on TENGCONTROL T-920 PLC v5.5 devices. It allows remote attackers to cause a denial of service (persistent failure mode) by sending a series of \x19\xb2\x00\x00\x00\x06\x43\x01\x00\xac\xff\x00 (aka UID 0x43) requests to TCP port 502.
CVSS Score: 7.5 (HIGH)
References: https://github.com/Ni9htMar3/vulnerability/blob/master/PLC/%E8%85%BE%E6%8E%A7/T920_PLC_DOS.md; https://github.com/Ni9htMar3/vulnerability/blob/master/PLC/%E8%85%BE%E6%8E%A7/T920_PLC_DOS.md
CVE: CVE-2019-9591
Published: 2019-03-06
Description: A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE before 19.49.1500.0 allows remote attackers to inject arbitrary web script or HTML via the brandUrl parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html; https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability; https://www.exploit-db.com/exploits/46666/
CVE: CVE-2019-9592
Published: 2019-03-06
Description: A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 19.45.1602.0 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html; https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability; https://www.exploit-db.com/exploits/46666/
CVE: CVE-2019-9593
Published: 2019-03-06
Description: A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/152431/ShoreTel-Connect-ONSITE-Cross-Site-Scripting-Session-Fixation.html; https://github.com/Ramikan/Vulnerabilities/blob/master/Shoretel%20Connect%20Multiple%20Vulnerability; https://www.exploit-db.com/exploits/46666/
CVE: CVE-2019-9594
Published: 2019-03-06
Description: BlueCMS 1.6 allows SQL Injection via the user_id parameter in an uploads/admin/user.php?act=edit request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/8test/pentest/issues/1; https://github.com/8test/pentest/issues/1
CVE: CVE-2019-9595
Published: 2019-03-06
Description: AppCMS 2.0.101 allows XSS via the upload/callback.php params parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/source-trace/appcms/issues/1; https://github.com/source-trace/appcms/issues/1
CVE: CVE-2019-0187
Published: 2019-03-06
Description: Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-327, CWE-502
References: http://mail-archives.apache.org/mod_mbox/jmeter-user/201903.mbox/%3CCAH9fUpaUQaFbgY1Zh4OvKSL4wdvGAmVt%2Bn4fegibDoAxK5XARw%40mail.gmail.com%3E; http://www.securityfocus.com/bid/107219; http://mail-archives.apache.org/mod_mbox/jmeter-user/201903.mbox/%3CCAH9fUpaUQaFbgY1Zh4OvKSL4wdvGAmVt%2Bn4fegibDoAxK5XARw%40mail.gmail.com%3E
CVE: CVE-2019-0200
Published: 2019-03-06
Description: A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
CVSS Score: 7.5 (HIGH)
References: http://www.securityfocus.com/bid/107215; https://lists.apache.org/thread.html/ac79d48de37d42b64da50384dbe9c8a329c5f553dd12ef7c28a832de%40%3Cusers.qpid.apache.org%3E; http://www.securityfocus.com/bid/107215
CVE: CVE-2019-9599
Published: 2019-03-06
Description: The AirDroid application through 4.2.1.6 for Android allows remote attackers to cause a denial of service (service crash) via many simultaneous sdctl/comm/lite_auth/ requests.
CVSS Score: 7.5 (HIGH)
References: https://www.exploit-db.com/exploits/46337; https://www.youtube.com/watch?v=0QDM224_6DM; https://www.exploit-db.com/exploits/46337
CVE: CVE-2019-9600
Published: 2019-03-06
Description: The Olive Tree FTP Server (aka com.theolivetree.ftpserver) application through 1.32 for Android allows remote attackers to cause a denial of service via a client that makes many connection attempts and drops certain packets.
CVSS Score: 7.5 (HIGH)
References: https://www.exploit-db.com/exploits/46464; https://www.youtube.com/watch?v=C8Nz3YmVc_g; https://www.exploit-db.com/exploits/46464
CVE: CVE-2019-9601
Published: 2019-03-06
Description: The ApowerManager application through 3.1.7 for Android allows remote attackers to cause a denial of service via many simultaneous /?Key=PhoneRequestAuthorization requests.
CVSS Score: 7.5 (HIGH)
References: https://www.exploit-db.com/exploits/46380; https://www.youtube.com/watch?v=9vD8GnKqDME; https://www.exploit-db.com/exploits/46380
CVE: CVE-2019-9603
Published: 2019-03-06
Description: MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: https://github.com/bg5sbk/MiniCMS/issues/29; https://github.com/bg5sbk/MiniCMS/issues/29
CVE: CVE-2018-1911
Published: 2019-03-06
Description: IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152735.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10873256; https://exchange.xforce.ibmcloud.com/vulnerabilities/152735; http://www.ibm.com/support/docview.wss?uid=ibm10873256
CVE: CVE-2018-1912
Published: 2019-03-06
Description: IBM DOORS Next Generation (DNG/RRC) 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152736.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10873254; https://exchange.xforce.ibmcloud.com/vulnerabilities/152736; http://www.ibm.com/support/docview.wss?uid=ibm10873254
CVE: CVE-2019-4030
Published: 2019-03-06
Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 155946.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10869406; https://exchange.xforce.ibmcloud.com/vulnerabilities/155946; http://www.ibm.com/support/docview.wss?uid=ibm10869406
CVE: CVE-2019-1543
Published: 2019-03-06
Description: ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).
CVSS Score: 7.4 (HIGH)
CWE: CWE-327, CWE-330
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html; https://access.redhat.com/errata/RHSA-2019:3700; https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ee22257b1418438ebaf54df98af4e24f494d1809
CVE: CVE-2019-1585
Published: 2019-03-06
Description: A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers files for the bashroot component on an affected device. An attacker could exploit this vulnerability by authenticating to the affected device with a crafted user ID, which may allow temporary administrative access to escalate privileges. A successful exploit could allow the attacker to escalate privileges on an affected device. This Vulnerability has been fixed in version 4.0(1h)
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-16, CWE-16
References: http://www.securityfocus.com/bid/107312; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-aci-controller-privsec; http://www.securityfocus.com/bid/107312
CVE: CVE-2019-1588
Published: 2019-03-06
Description: A vulnerability in the Cisco Nexus 9000 Series Fabric Switches running in Application-Centric Infrastructure (ACI) mode could allow an authenticated, local attacker to read arbitrary files on an affected device. The vulnerability is due to a lack of proper input and validation checking mechanisms of user-supplied input sent to an affected device. A successful exploit could allow the attacker unauthorized access to read arbitrary files on an affected device. This vulnerability has been fixed in version 14.0(1h).
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-20, CWE-269
References: http://www.securityfocus.com/bid/107316; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-aci-file-read; http://www.securityfocus.com/bid/107316
CVE: CVE-2019-1591
Published: 2019-03-06
Description: A vulnerability in a specific CLI command implementation of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escape a restricted shell on an affected device. The vulnerability is due to insufficient sanitization of user-supplied input when issuing a specific CLI command with parameters on an affected device. An attacker could exploit this vulnerability by authenticating to the device CLI and issuing certain commands. A successful exploit could allow the attacker to escape the restricted shell and execute arbitrary commands with root-level privileges on the affected device. This vulnerability only affects Cisco Nexus 9000 Series ACI Mode Switches that are running a release prior to 14.0(3d).
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-78
References: http://www.securityfocus.com/bid/107311; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-aci-shell-escape; http://www.securityfocus.com/bid/107311
CVE: CVE-2019-1593
Published: 2019-03-06
Description: A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to escalate their privilege level by executing commands authorized to other user roles. The attacker must authenticate with valid user credentials. The vulnerability is due to the incorrect implementation of a Bash shell command that allows role-based access control (RBAC) to be bypassed. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Bash prompt. A successful exploit could allow the attacker to escalate their privilege level by executing commands that should be restricted to other roles. For example, a dev-ops user could escalate their privilege level to admin with a successful exploit of this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/107324; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nx-os-bash-escal; http://www.securityfocus.com/bid/107324
CVE: CVE-2019-1594
Published: 2019-03-06
Description: A vulnerability in the 802.1X implementation for Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incomplete input validation of Extensible Authentication Protocol over LAN (EAPOL) frames. An attacker could exploit this vulnerability by sending a crafted EAPOL frame to an interface on the targeted device. A successful exploit could allow the attacker to cause the Layer 2 (L2) forwarding process to restart multiple times, leading to a system-level restart of the device and a DoS condition. Note: This vulnerability affects only NX-OS devices configured with 802.1X functionality. Cisco Nexus 1000V Switch for VMware vSphere devices are affected in versions prior to 5.2(1)SV3(1.4b). Nexus 3000 Series Switches are affected in versions prior to 7.0(3)I7(4). Nexus 3500 Platform Switches are affected in versions prior to 7.0(3)I7(4). Nexus 2000, 5500, 5600, and 6000 Series Switches are affected in versions prior to 7.3(5)N1(1) and 7.1(5)N1(1b). Nexus 7000 and 7700 Series Switches are affected in versions prior to 8.2(3). Nexus 9000 Series Fabric Switches in ACI Mode are affected in versions prior to 13.2(1l). Nexus 9000 Series Switches in Standalone NX-OS Mode are affected in versions prior to 7.0(3)I7(4).
CVSS Score: 7.4 (HIGH)
CWE: CWE-264, CWE-20
References: http://www.securityfocus.com/bid/107325; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190306-nx-os-lan-auth; http://www.securityfocus.com/bid/107325