deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-15400
Published: 2018-10-05
Description: A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/105560; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-csp-xss; http://www.securityfocus.com/bid/105560
CVE: CVE-2018-15401
Published: 2018-10-05
Description: A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system via a web browser and with the privileges of the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hcmf-csrf; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hcmf-csrf
CVE: CVE-2018-15403
Published: 2018-10-05
Description: A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: http://www.securitytracker.com/id/1041780; http://www.securitytracker.com/id/1041789; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirect
CVE: CVE-2018-15404
Published: 2018-10-05
Description: A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-399, CWE-770
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-imcs-ucsd-dos; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-imcs-ucsd-dos
CVE: CVE-2018-15405
Published: 2018-10-05
Description: A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly include the access level of the web interface user. An attacker who has valid application credentials could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional reconnaissance attacks.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285, CWE-863
References: http://www.securitytracker.com/id/1041779; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-imcs-ucsd-id; http://www.securitytracker.com/id/1041779
CVE: CVE-2018-15406
Published: 2018-10-05
Description: A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securitytracker.com/id/1041783; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ucsd-xss; http://www.securitytracker.com/id/1041783
CVE: CVE-2018-15407
Published: 2018-10-05
Description: A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnerability is due to insufficient cleanup of installation files. An attacker could exploit this vulnerability by accessing the residual installation files on an affected system. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-459
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-info; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-info
CVE: CVE-2018-15408
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15409
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15410
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15411
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15412
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15413
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15414
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105374; http://www.securitytracker.com/id/1041689; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180919-webex
CVE: CVE-2018-15415
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15416
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15417
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15418
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-191
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15419
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15420
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-20
References: http://www.securityfocus.com/bid/105520; http://www.securitytracker.com/id/1041795; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
CVE: CVE-2018-15421
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: http://www.securityfocus.com/bid/105374; http://www.securitytracker.com/id/1041689; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180919-webex
CVE: CVE-2018-15422
Published: 2018-10-05
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-787
References: http://www.securityfocus.com/bid/105374; http://www.securitytracker.com/id/1041689; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180919-webex
CVE: CVE-2018-15423
Published: 2018-10-05
Description: A vulnerability in the web UI of Cisco HyperFlex Software could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-693, CWE-1021
References: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-clickjacking; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-hyperflex-clickjacking
CVE: CVE-2018-15424
Published: 2018-10-05
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20, CWE-434
References: http://www.securitytracker.com/id/1041792; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ise-mult-vulns; http://www.securitytracker.com/id/1041792
CVE: CVE-2018-15425
Published: 2018-10-05
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device with the privileges of the web server.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20, CWE-502
References: http://www.securitytracker.com/id/1041792; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-ise-mult-vulns; http://www.securitytracker.com/id/1041792
CVE: CVE-2018-15426
Published: 2018-10-05
Description: A vulnerability in the web-based interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the web-based interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securitytracker.com/id/1041781; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-uc-xss; http://www.securitytracker.com/id/1041781