deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-31
Description: VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://security.cucumberlinux.com/security/details.php?id=120; http://www.openwall.com/lists/oss-security/2017/10/31/1; http://security.cucumberlinux.com/security/details.php?id=120
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-31
Description: GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://www.openwall.com/lists/oss-security/2017/10/31/1; http://www.securityfocus.com/bid/101671; http://www.openwall.com/lists/oss-security/2017/10/31/1
CVE: CVE-2[PII_REDACTED]
Published: 2017-10-31
Description: An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-119, CWE-119
References: http://www.debian.org/security/2017/dsa-4007; http://www.securityfocus.com/bid/101519; http://www.securitytracker.com/id/1039644
CVE: CVE-2017-14375
Published: 2017-11-01
Description: EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, and EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier) contain an authentication bypass vulnerability that may potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-290
References: http://seclists.org/fulldisclosure/2017/Oct/70; http://www.securityfocus.com/bid/101673; http://www.securitytracker.com/id/1039704
CVE: CVE-2017-14376
Published: 2017-11-01
Description: EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: http://seclists.org/fulldisclosure/2017/Oct/68; http://www.securityfocus.com/bid/101626; http://seclists.org/fulldisclosure/2017/Oct/68
CVE: CVE-2017-15535
Published: 2017-11-01
Description: MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompressors (aka wire protocol compression), which exposes a vulnerability when enabled that could be exploited by a malicious attacker to deny service or modify memory.
CVSS Score: 9.1 (CRITICAL)
References: http://www.securityfocus.com/bid/101689; https://jira.mongodb.org/browse/SERVER-31273; http://www.securityfocus.com/bid/101689
CVE: CVE-2017-16244
Published: 2017-11-01
Description: Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0; https://www.exploit-db.com/exploits/43106/; https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0
CVE: CVE-2017-16248
Published: 2017-11-01
Description: The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://bugs.debian.org/880458; https://metacpan.org/changes/distribution/Catalyst-Plugin-Static-Simple; https://rt.cpan.org/Public/Bug/Display.html?id=120558
CVE: CVE-2017-14021
Published: 2017-11-01
Description: A Use of Hard-coded Cryptographic Key issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNet5628G-R version 1.4, JetNet5628G version 1.4, JetNet5728G-24P version 1.4, JetNet5828G version 1.1d, JetNet6710G-HVDC version 1.1e, and JetNet6710G version 1.1. An attacker may gain access to hard-coded certificates and private keys allowing the attacker to perform man-in-the-middle attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321, CWE-798
References: http://www.securityfocus.com/bid/101598; https://ics-cert.us-cert.gov/advisories/ICSA-17-299-01; http://www.securityfocus.com/bid/101598
CVE: CVE-2017-14027
Published: 2017-11-01
Description: A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1.4, JetNet5628G-R version 1.4, JetNet5628G version 1.4, JetNet5728G-24P version 1.4, JetNet5828G version 1.1d, JetNet6710G-HVDC version 1.1e, and JetNet6710G version 1.1. The software uses undocumented hard-coded credentials that may allow an attacker to gain remote access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/101598; https://ics-cert.us-cert.gov/advisories/ICSA-17-299-01; http://www.securityfocus.com/bid/101598
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-01
Description: Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101940; https://jenkins.io/security/advisory/2017-04-27/; http://www.securityfocus.com/bid/101940
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-01
Description: Jenkins Favorite Plugin 2.1.4 and older does not perform permission checks when changing favorite status, allowing any user to set any other user's favorites
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.securityfocus.com/bid/101946; https://jenkins.io/security/advisory/2017-06-06/; http://www.securityfocus.com/bid/101946
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-01
Description: Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/101943; https://jenkins.io/security/advisory/2017-06-06/; http://www.securityfocus.com/bid/101943
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-01
Description: The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-522
References: https://jenkins.io/security/advisory/2017-07-10/; https://jenkins.io/security/advisory/2017-07-10/
CVE: CVE-2017-12625
Published: 2017-11-01
Description: Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://mail-archives.apache.org/mod_mbox/hive-user/201710.mbox/%3C3791103E-80D5-4E75-AF23-6F8ED54DDEBE%40apache.org%3E; http://www.securityfocus.com/bid/101686; http://mail-archives.apache.org/mod_mbox/hive-user/201710.mbox/%3C3791103E-80D5-4E75-AF23-6F8ED54DDEBE%40apache.org%3E
CVE: CVE-2017-16352
Published: 2017-11-01
Description: GraphicsMagick 1.3.26 is vulnerable to a heap-based buffer overflow vulnerability found in the "Display visual image directory" feature of the DescribeImage() function of the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt; http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=7292230dd185; http://www.securityfocus.com/bid/101658
CVE: CVE-2017-16353
Published: 2017-11-01
Description: GraphicsMagick 1.3.26 is vulnerable to a memory information disclosure vulnerability found in the DescribeImage function of the magick/describe.c file, because of a heap-based buffer over-read. The portion of the code containing the vulnerability is responsible for printing the IPTC Profile information contained in the image. This vulnerability can be triggered with a specially crafted MIFF file. There is an out-of-bounds buffer dereference because certain increments are never checked.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-200
References: ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt; http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=e4e1c2a581d8; http://www.securityfocus.com/bid/101653
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-01
Description: PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/pluxml/PluXml/issues/253; https://github.com/pluxml/PluXml/issues/253
CVE: CVE-2017-14992
Published: 2017-11-01
Description: Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/; https://github.com/moby/moby/issues/35075; https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992/
CVE: CVE-2017-15566
Published: 2017-11-01
Description: Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.securityfocus.com/bid/101675; https://www.debian.org/security/2017/dsa-4023; https://www.schedmd.com/news.php?id=193#OPT_193
CVE: CVE-2017-15918
Published: 2017-11-01
Description: Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://m4.rkw.io/blog/cve201715918-sera-12-local-root-privesc-and-password-disclosure.html; https://www.exploit-db.com/exploits/43221/; https://m4.rkw.io/blog/cve201715918-sera-12-local-root-privesc-and-password-disclosure.html
CVE: CVE-2017-16357
Published: 2017-11-01
Description: In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/radare/radare2/commit/0b973e28166636e0ff1fad80baa0385c9c09c53a; https://github.com/radare/radare2/issues/8742; https://github.com/radare/radare2/commit/0b973e28166636e0ff1fad80baa0385c9c09c53a
CVE: CVE-2017-16358
Published: 2017-11-01
Description: In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://github.com/radare/radare2/commit/d31c4d3cbdbe01ea3ded16a584de94149ecd31d9; https://github.com/radare/radare2/issues/8748; https://github.com/radare/radare2/commit/d31c4d3cbdbe01ea3ded16a584de94149ecd31d9
CVE: CVE-2017-16359
Published: 2017-11-01
Description: In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://github.com/radare/radare2/commit/62e39f34b2705131a2d08aff0c2e542c6a52cf0e; https://github.com/radare/radare2/commit/d21e91f075a7a7a8ed23baa5c1bb1fac48313882; https://github.com/radare/radare2/commit/fbaf24bce7ea4211e4608b3ab6c1b45702cb243d
CVE: CVE-2016-3048
Published: 2017-11-01
Description: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114711.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21997685; http://www.securityfocus.com/bid/101660; https://exchange.xforce.ibmcloud.com/vulnerabilities/114711
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-01
Description: The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: http://trac.webkit.org/changeset/217126/webkit; https://webkitgtk.org/security/WSA-2017-0007.html; http://trac.webkit.org/changeset/217126/webkit
CVE: CVE-2[PII_REDACTED]
Published: 2017-11-01
Description: The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://trac.webkit.org/changeset/217206; https://webkitgtk.org/security/WSA-2017-0007.html; http://trac.webkit.org/changeset/217206
CVE: CVE-2017-1147
Published: 2017-11-01
Description: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 122200.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg21997685; http://www.securityfocus.com/bid/101663; https://exchange.xforce.ibmcloud.com/vulnerabilities/122200
CVE: CVE-2017-1148
Published: 2017-11-01
Description: IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry (LEE) application could allow a user to obtain sensitive information including private APIs that could be used in further attacks against the system. IBM X-Force ID: 122201.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22009717; http://www.securityfocus.com/bid/101668; https://exchange.xforce.ibmcloud.com/vulnerabilities/122201
CVE: CVE-2017-1290
Published: 2017-11-01
Description: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125151.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22009770; http://www.securityfocus.com/bid/101684; https://exchange.xforce.ibmcloud.com/vulnerabilities/125151
CVE: CVE-2017-1300
Published: 2017-11-01
Description: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 125162.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg22009684; http://www.securityfocus.com/bid/101939; https://exchange.xforce.ibmcloud.com/vulnerabilities/125162
CVE: CVE-2017-1333
Published: 2017-11-01
Description: IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that could be used in future attacks against the system. IBM X-Force ID: 126241.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg21997796; http://www.securityfocus.com/bid/101656; https://exchange.xforce.ibmcloud.com/vulnerabilities/126241
CVE: CVE-2017-1340
Published: 2017-11-01
Description: IBM Jazz Reporting Service (JRS) 6.0.4 could allow an authenticated user to obtain information on another server that the current report builder interacts with. IBM X-Force ID: 126455.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22009973; http://www.securityfocus.com/bid/101880; https://exchange.xforce.ibmcloud.com/vulnerabilities/126455
CVE: CVE-2017-1552
Published: 2017-11-01
Description: IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to link injection. By persuading a victim to click on a specially-crafted URL link, a remote attacker could exploit this vulnerability to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 131396.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22009192; http://www.securityfocus.com/bid/101588; https://exchange.xforce.ibmcloud.com/vulnerabilities/131396
CVE: CVE-2017-1553
Published: 2017-11-01
Description: IBM Infosphere BigInsights 4.2.0 and 4.2.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131397.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22009192; http://www.securityfocus.com/bid/101588; https://exchange.xforce.ibmcloud.com/vulnerabilities/131397
CVE: CVE-2017-1554
Published: 2017-11-01
Description: IBM Infosphere BigInsights 4.2.0 and 4.2.5 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 131398.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22009192; http://www.securityfocus.com/bid/101588; https://exchange.xforce.ibmcloud.com/vulnerabilities/131398
CVE: CVE-2017-10825
Published: 2017-11-02
Description: Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://flets-w.com/topics/setup_tool_vulnerability/; https://jvn.jp/en/jp/JVN97243511/278948/index.html; http://flets-w.com/topics/setup_tool_vulnerability/
CVE: CVE-2017-10870
Published: 2017-11-02
Description: Memory corruption vulnerability in Rakuraku Hagaki (Rakuraku Hagaki 2018, Rakuraku Hagaki 2017, Rakuraku Hagaki 2016) and Rakuraku Hagaki Select for Ichitaro (Ichitaro 2017, Ichitaro 2016, Ichitaro 2015, Ichitaro Pro3, Ichitaro Pro2, Ichitaro Pro, Ichitaro 2011, Ichitaro Government 8, Ichitaro Government 7, Ichitaro Government 6 and Ichitaro 2017 Trial version) allows attackers to execute arbitrary code with privileges of the application via specially crafted file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://jvn.jp/en/vu/JVNVU93703434/index.html; https://www.justsystems.com/jp/info/js17003.html; https://jvn.jp/en/vu/JVNVU93703434/index.html
CVE: CVE-2017-10873
Published: 2017-11-02
Description: OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.
CVSS Score: 8.1 (HIGH)
CWE: CWE-287
References: https://jvn.jp/en/jp/JVN79546124/; https://www.cs.themistruct.com/; https://www.osstech.co.jp/support/am2017-2-1-en
CVE: CVE-2017-12243
Published: 2017-11-02
Description: A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device, aka Command Injection. The vulnerability is due to improper validation of string input in the shell application. An attacker could exploit this vulnerability through the use of malicious commands. A successful exploit could allow the attacker to obtain root shell privileges on the device. Cisco Bug IDs: CSCvf20741, CSCvf60078.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/101652; http://www.securitytracker.com/id/1039719; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-arce
CVE: CVE-2017-12261
Published: 2017-11-02
Description: A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) that is accessible via SSH could allow an authenticated, local attacker to run arbitrary CLI commands with elevated privileges. The vulnerability is due to incomplete input validation of the user input for CLI commands issued at the restricted shell. An attacker could exploit this vulnerability by authenticating to the targeted device and executing commands that could lead to elevated privileges. An attacker would need valid user credentials to the device to exploit this vulnerability. The vulnerability affects the following Cisco Identity Services Engine (ISE) products running Release 1.4, 2.0, 2.0.1, 2.1.0: ISE, ISE Express, ISE Virtual Appliance. Cisco Bug IDs: CSCve74916.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264, CWE-863
References: http://www.securityfocus.com/bid/101641; http://www.securitytracker.com/id/1039717; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-ise