deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1782
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108407; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-fxos-nxos-cmdinj-1781-1782; http://www.securityfocus.com/bid/108407
CVE: CVE-2019-1783
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108370; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1783; http://www.securityfocus.com/bid/108370
CVE: CVE-2019-1784
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108369; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmd-inject-1784; http://www.securityfocus.com/bid/108369
CVE: CVE-2019-1790
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with valid administrator credentials to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108383; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1790; http://www.securityfocus.com/bid/108383
CVE: CVE-2019-9196
Published: 2019-05-15
Description: The Face authentication component in Aware mobile liveness 2.2.1 sdk 2.2.0 for Knomi allows a Biometrical Liveness authentication bypass via parameter tampering of the /knomi/analyze security_level field.
CVSS Score: 7.5 (HIGH)
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://drive.google.com/open?id=1-0X8foCwjR3RmL_7UJcgOFYrwKOjYZQL; https://ibb.co/n7LS34g
CVE: CVE-2019-1791
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108390; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1791; http://www.securityfocus.com/bid/108390
CVE: CVE-2019-1795
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108479; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1795; http://www.securityfocus.com/bid/108479
CVE: CVE-2019-1806
Published: 2019-05-15
Description: A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco Small Business Sx200, Sx300, Sx500, ESW2 Series Managed Switches and Small Business Sx250, Sx350, Sx550 Series Switches could allow an authenticated, remote attacker to cause the SNMP application of an affected device to cease processing traffic, resulting in the CPU utilization reaching one hundred percent. Manual intervention may be required before a device resumes normal operations. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a malicious SNMP packet to an affected device. A successful exploit could allow the attacker to cause the device to cease forwarding traffic, which could result in a denial of service (DoS) condition. Cisco has released firmware updates that address this vulnerability.
CVSS Score: 7.7 (HIGH)
CWE: CWE-20, CWE-770
References: http://www.securityfocus.com/bid/108335; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-sb-snmpdos; http://www.securityfocus.com/bid/108335
CVE: CVE-2019-12098
Published: 2019-05-15
Description: In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html
CVE: CVE-2019-12106
Published: 2019-05-15
Description: The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: https://github.com/miniupnp/miniupnp/commit/cd506a67e174a45c6a202eff182a712955ed6d6f; https://lists.debian.org/debian-lts-announce/2019/05/msg00037.html; https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp
CVE: CVE-2019-12107
Published: 2019-05-15
Description: The upnp_event_prepare function in upnpevents.c in MiniUPnP MiniUPnPd through 2.1 allows a remote attacker to leak information from the heap due to improper validation of an snprintf return value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-252
References: https://github.com/miniupnp/miniupnp/commit/bec6ccec63cadc95655721bc0e1dd49dac759d94; https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html; https://usn.ubuntu.com/4542-1/
CVE: CVE-2019-12108
Published: 2019-05-15
Description: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for int_port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/miniupnp/miniupnp/commit/13585f15c7f7dc28bbbba1661efb280d530d114c; https://github.com/miniupnp/miniupnp/commit/86030db849260dd8fb2ed975b9890aef1b62b692; https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
CVE: CVE-2019-12109
Published: 2019-05-15
Description: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in GetOutboundPinholeTimeout in upnpsoap.c for rem_port.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/miniupnp/miniupnp/commit/13585f15c7f7dc28bbbba1661efb280d530d114c; https://github.com/miniupnp/miniupnp/commit/86030db849260dd8fb2ed975b9890aef1b62b692; https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
CVE: CVE-2019-12110
Published: 2019-05-15
Description: An AddPortMapping Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in upnpredirect.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/miniupnp/miniupnp/commit/f321c2066b96d18afa5158dfa2d2873a2957ef38; https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html; https://usn.ubuntu.com/4542-1/
CVE: CVE-2019-12111
Published: 2019-05-15
Description: A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://github.com/miniupnp/miniupnp/commit/cb8a02af7a5677cf608e86d57ab04241cf34e24f; https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html; https://usn.ubuntu.com/4542-1/
CVE: CVE-2019-1808
Published: 2019-05-15
Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by loading an unsigned software patch on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/108367; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-spsv; http://www.securityfocus.com/bid/108367
CVE: CVE-2019-1809
Published: 2019-05-15
Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/108375; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-psvb; http://www.securityfocus.com/bid/108375
CVE: CVE-2019-1810
Published: 2019-05-15
Description: A vulnerability in the Image Signature Verification feature used in an NX-OS CLI command in Cisco Nexus 3000 Series and 9000 Series Switches could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device. Note: If the device has not been patched for the vulnerability previously disclosed in the Cisco Security Advisory cisco-sa-20190306-nxos-sig-verif, a successful exploit could allow the attacker to boot a malicious software image.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/108431; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv; http://www.securityfocus.com/bid/108431
CVE: CVE-2019-1811
Published: 2019-05-15
Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/108425; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv2; http://www.securityfocus.com/bid/108425
CVE: CVE-2019-1812
Published: 2019-05-15
Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/108425; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv2; http://www.securityfocus.com/bid/108425
CVE: CVE-2019-1813
Published: 2019-05-15
Description: A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software image on an affected device. The vulnerability exists because software digital signatures are not properly verified during CLI command execution. An attacker could exploit this vulnerability to install an unsigned software image on an affected device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/108425; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-sisv2; http://www.securityfocus.com/bid/108425
CVE: CVE-2019-1814
Published: 2019-05-16
Description: A vulnerability in the interactions between the DHCP and TFTP features for Cisco Small Business 300 Series (Sx300) Managed Switches could allow an unauthenticated, remote attacker to cause the device to become low on system memory, which in turn could lead to an unexpected reload of the device and result in a denial of service (DoS) condition on an affected device. The vulnerability is due to a failure to free system memory when an unexpected DHCP request is received. An attacker could exploit this vulnerability by sending a crafted DHCP packet to the targeted device. A successful exploit could allow the attacker to cause an unexpected reload of the device.
CVSS Score: 8.6 (HIGH)
CWE: CWE-400, CWE-770
References: http://www.securityfocus.com/bid/108344; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-sb300sms-dhcp; http://www.securityfocus.com/bid/108344
CVE: CVE-2019-1818
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/108352; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1818; http://www.securityfocus.com/bid/108352
CVE: CVE-2019-1819
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/108351; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1819; http://www.securityfocus.com/bid/108351
CVE: CVE-2019-1820
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: http://www.securityfocus.com/bid/108345; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1820; http://www.securityfocus.com/bid/108345
CVE: CVE-2019-1821
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html; http://www.securityfocus.com/bid/108339; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce
CVE: CVE-2019-1822
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108339; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce; http://www.securityfocus.com/bid/108339
CVE: CVE-2019-1823
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/108339; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce; http://www.securityfocus.com/bid/108339
CVE: CVE-2019-1824
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/108337; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject; http://www.securityfocus.com/bid/108337
CVE: CVE-2019-1825
Published: 2019-05-16
Description: A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
CVSS Score: 8.1 (HIGH)
CWE: CWE-89, CWE-89
References: http://www.securityfocus.com/bid/108337; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject; http://www.securityfocus.com/bid/108337