deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-0322
Published: 2018-06-07
Description: A vulnerability in the web management interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to modify sensitive data that is associated with arbitrary accounts on an affected device. The vulnerability is due to a failure to enforce access restrictions on the Help Desk and User Provisioning roles that are assigned to authenticated users. This failure could allow an authenticated attacker to modify critical attributes of higher-privileged accounts on the device. A successful exploit could allow the attacker to gain elevated privileges on the device. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.1 and prior. Cisco Bug IDs: CSCvd61779.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-862
References: http://www.securityfocus.com/bid/104443; http://www.securitytracker.com/id/1041064; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-access
CVE: CVE-2018-0353
Published: 2018-06-07
Description: A vulnerability in traffic-monitoring functions in Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to circumvent Layer 4 Traffic Monitor (L4TM) functionality and bypass security protections. The vulnerability is due to a change in the underlying operating system software that is responsible for monitoring affected traffic. An attacker could exploit this vulnerability by sending crafted IP packets to an affected device. A successful exploit could allow the attacker to pass traffic through the device, which the WSA was configured to deny. This vulnerability affects both IPv4 and IPv6 traffic. This vulnerability affects Cisco AsyncOS versions for WSA on both virtual and hardware appliances running any release of the 10.5.1, 10.5.2, or 11.0.0 WSA Software. The WSA is vulnerable if it is configured for L4TM. Cisco Bug IDs: CSCvg78875.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/104417; http://www.securitytracker.com/id/1041081; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-wsa
CVE: CVE-2018-12015
Published: 2018-06-07
Description: In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: http://seclists.org/fulldisclosure/2019/Mar/49; http://www.securityfocus.com/bid/104423; http://www.securitytracker.com/id/1041048
CVE: CVE-2018-7688
Published: 2018-06-07
Description: A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7688; https://github.com/openSUSE/open-build-service/commit/b15cf19e9e01115f653c76ffdc8f54cd97566553; https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
CVE: CVE-2018-7689
Published: 2018-06-07
Description: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2018-7689; https://github.com/openSUSE/open-build-service/commit/990ef7cccef6f38fc1d1a1bb22a08e174dcba43b; https://lists.opensuse.org/opensuse-buildservice/2018-06/msg00014.html
CVE: CVE-2018-12016
Published: 2018-06-07
Description: libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls.
CVSS Score: 7.5 (HIGH)
References: https://github.com/ldpreload/Disclosure/blob/master/EpiphanyDoS.txt; https://github.com/ldpreload/Disclosure/blob/master/EpiphanyDoS.txt
CVE: CVE-2018-1514
Published: 2018-06-07
Description: IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 141622.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://www.ibm.com/support/docview.wss?uid=swg22016099; https://exchange.xforce.ibmcloud.com/vulnerabilities/141622; http://www.ibm.com/support/docview.wss?uid=swg22016099
CVE: CVE-2018-1547
Published: 2018-06-07
Description: IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run any command or program on the victim's machine. IBM X-Force ID: 142651.
CVSS Score: 8.0 (HIGH)
References: http://www.ibm.com/support/docview.wss?uid=swg22016197; http://www.securityfocus.com/bid/104469; https://exchange.xforce.ibmcloud.com/vulnerabilities/142651
CVE: CVE-2018-12031
Published: 2018-06-07
Description: Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/EmreOvunc/Eaton-Intelligent-Power-Manager-Local-File-Inclusion; https://github.com/EmreOvunc/Eaton-Intelligent-Power-Manager-Local-File-Inclusion
CVE: CVE-2018-12036
Published: 2018-06-07
Description: OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-123
References: https://github.com/jeremylong/DependencyCheck/blob/master/RELEASE_NOTES.md#version-320-2018-05-21; https://github.com/snyk/zip-slip-vulnerability; https://github.com/jeremylong/DependencyCheck/blob/master/RELEASE_NOTES.md#version-320-2018-05-21
CVE: CVE-2018-6670
Published: 2018-06-07
Description: External Entity Attack vulnerability in the ePO extension in McAfee Common UI (CUI) 2.0.2 allows remote authenticated users to view confidential information via a crafted HTTP request parameter.
CVSS Score: 7.6 (HIGH)
CWE: CWE-611
References: https://kc.mcafee.com/corporate/index?page=content&id=SB10236; https://kc.mcafee.com/corporate/index?page=content&id=SB10236
CVE: CVE-2017-6290
Published: 2018-06-07
Description: In Android before the 2018-06-05 security patch level, NVIDIA TLK TrustZone contains a possible out of bounds write due to an integer overflow which could lead to local escalation of privilege with no additional execution privileges needed. User interaction not needed for exploitation. This issue is rated as high. Version: N/A. Android: A-69559414. Reference: N-CVE-2017-6290.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: https://source.android.com/security/bulletin/2018-06-01; https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2017-6292
Published: 2018-06-07
Description: In Android before the 2018-06-05 security patch level, NVIDIA TLZ TrustZone contains a possible out of bounds write due to integer overflow which could lead to local escalation of privilege in the TrustZone with no additional execution privileges needed. User interaction is not needed for exploitation. This issue is rated as high. Version: N/A. Android: A-69480285. Reference: N-CVE-2017-6292.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-06-01; https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2017-6294
Published: 2018-06-07
Description: In Android before the 2018-06-05 security patch level, NVIDIA Tegra X1 TZ contains a possible out of bounds write due to missing bounds check which could lead to escalation of privilege from the kernel to the TZ. User interaction is not needed for exploitation. This issue is rated as high. Version: N/A. Android: A-69316825. Reference: N-CVE-2017-6294.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/2018-06-01; https://source.android.com/security/bulletin/2018-06-01
CVE: CVE-2018-12039
Published: 2018-06-07
Description: joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/joyplus/joyplus-cms/issues/425; https://github.com/joyplus/joyplus-cms/issues/425
CVE: CVE-2018-10619
Published: 2018-06-07
Description: An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized, but non-privileged local user to execute arbitrary code and allow a threat actor to escalate user privileges on the affected workstation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-428, CWE-428
References: http://www.securityfocus.com/bid/104415; https://ics-cert.us-cert.gov/advisories/ICSA-18-158-01; https://www.exploit-db.com/exploits/44892/
CVE: CVE-2018-12042
Published: 2018-06-07
Description: Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://xkklq.coding.me/2018/06/07/roxyfileman-download/; https://xkklq.coding.me/2018/06/07/roxyfileman-download/
CVE: CVE-2018-12043
Published: 2018-06-07
Description: content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/symphonycms/symphony-2/commit/1ace6b31867cc83267b[PII_REDACTED]c9c65ac3ec0; https://github.com/symphonycms/symphony-2/commit/1ace6b31867cc83267b[PII_REDACTED]c9c65ac3ec0
CVE: CVE-2011-0467
Published: 2018-06-07
Description: A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected releases are SUSE Studio Onsite: versions prior to 1.0.3-0.18.1, SUSE Studio Onsite 1.1 Appliance: versions prior to 1.1.2-0.25.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://bugzilla.suse.com/show_bug.cgi?id=675039; https://www.suse.com/security/cve/CVE-2011-0467/; https://bugzilla.suse.com/show_bug.cgi?id=675039
CVE: CVE-2018-0149
Published: 2018-06-07
Description: A vulnerability in the web-based management interface of Cisco Integrated Management Controller Supervisor Software and Cisco UCS Director Software could allow an authenticated, remote attacker to conduct a Document Object Model-based (DOM-based), stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or allow the attacker to access sensitive browser-based information on the affected device. Cisco Bug IDs: CSCvh12994.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104444; http://www.securitytracker.com/id/1041072; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ucsdimcs
CVE: CVE-2018-0329
Published: 2018-06-07
Description: A vulnerability in the default configuration of the Simple Network Management Protocol (SNMP) feature of Cisco Wide Area Application Services (WAAS) Software could allow an unauthenticated, remote attacker to read data from an affected device via SNMP. The vulnerability is due to a hard-coded, read-only community string in the configuration file for the SNMP daemon. An attacker could exploit this vulnerability by using the static community string in SNMP version 2c queries to an affected device. A successful exploit could allow the attacker to read any data that is accessible via SNMP on the affected device. Note: The static credentials are defined in an internal configuration file and are not visible in the current operation configuration ('running-config') or the startup configuration ('startup-config'). Cisco Bug IDs: CSCvi40137.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-798, CWE-798
References: http://www.securityfocus.com/bid/104590; http://www.securitytracker.com/id/1041078; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-snmp
CVE: CVE-2018-0332
Published: 2018-06-07
Description: A vulnerability in the Session Initiation Protocol (SIP) ingress packet processing of Cisco Unified IP Phone software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to a lack of flow-control mechanisms in the software. An attacker could exploit this vulnerability by sending high volumes of SIP INVITE traffic to the targeted device. Successful exploitation could allow the attacker to cause a disruption of services on the targeted IP phone. Cisco Bug IDs: CSCve10064, CSCve14617, CSCve14638, CSCve14683, CSCve20812, CSCve20926, CSCve20945.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/104445; http://www.securitytracker.com/id/1041074; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ip-phone-dos
CVE: CVE-2018-0333
Published: 2018-06-07
Description: A vulnerability in the VPN configuration management of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass VPN security due to unintended side effects of dynamic configuration changes that could allow an attacker to bypass configured policies. The vulnerability is due to incorrect management of the configured interface names and VPN parameters when dynamic CLI configuration changes are performed. An attacker could exploit this vulnerability by sending packets through an interface on the targeted device. A successful exploit could allow the attacker to bypass configured VPN policies. Cisco Bug IDs: CSCvh49388.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-693, CWE-693
References: http://www.securityfocus.com/bid/104422; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-FireSIGHT-vpn-bypass; http://www.securityfocus.com/bid/104422
CVE: CVE-2018-0334
Published: 2018-06-07
Description: A vulnerability in the certificate management subsystem of Cisco AnyConnect Network Access Manager and of Cisco AnyConnect Secure Mobility Client for iOS, Mac OS X, Android, Windows, and Linux could allow an unauthenticated, remote attacker to bypass the TLS certificate check when downloading certain configuration files. The vulnerability is due to improper use of Simple Certificate Enrollment Protocol and improper server certificate validation. An attacker could exploit this vulnerability by preparing malicious profile and localization files for Cisco AnyConnect to use. A successful exploit could allow the attacker to remotely change the configuration profile, a certificate, or the localization data used by AnyConnect Secure Mobility Client. Cisco Bug IDs: CSCvh23141.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-295, CWE-295
References: http://www.securityfocus.com/bid/104430; http://www.securitytracker.com/id/1041075; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-AnyConnect-cert-bypass
CVE: CVE-2018-0335
Published: 2018-06-07
Description: A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensitive data. The vulnerability is due to improper logging of authentication data. An attacker could exploit this vulnerability by monitoring a specific World-Readable file for this authentication data (Cleartext Passwords). An exploit could allow the attacker to gain authentication information for other users. Cisco Bug IDs: CSCvd86602.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200, CWE-522, CWE-532
References: http://www.securityfocus.com/bid/104473; http://www.securitytracker.com/id/1041069; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cpcp-id
CVE: CVE-2018-0336
Published: 2018-06-07
Description: A vulnerability in the batch provisioning feature of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to escalate privileges to the Administrator level. The vulnerability is due to insufficient authorization enforcement on batch processing. An attacker could exploit this vulnerability by uploading a batch file and having the batch file processed by the system. A successful exploit could allow the attacker to escalate privileges to the Administrator level. Cisco Bug IDs: CSCvd86578.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264, CWE-862
References: http://www.securityfocus.com/bid/104429; http://www.securitytracker.com/id/1041083; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-escalation
CVE: CVE-2018-0338
Published: 2018-06-07
Description: A vulnerability in the role-based access-checking mechanisms of Cisco Unified Computing System (UCS) Software could allow an authenticated, local attacker to execute arbitrary commands on an affected system. The vulnerability exists because the affected software lacks proper input and validation checks for certain file systems. An attacker could exploit this vulnerability by issuing crafted commands in the CLI of an affected system. A successful exploit could allow the attacker to cause other users to execute unwanted arbitrary commands on the affected system. Cisco Bug IDs: CSCvf52994.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-863
References: http://www.securityfocus.com/bid/104456; http://www.securitytracker.com/id/1041071; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ucs-access
CVE: CVE-2018-0339
Published: 2018-06-07
Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some parameters passed to the web-based management interface. An attacker could exploit this vulnerability by convincing a user of the interface to click a specific link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf72309.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104424; http://www.securitytracker.com/id/1041066; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ise-xss
CVE: CVE-2018-0340
Published: 2018-06-07
Description: A vulnerability in the web framework of the Cisco Unified Communications Manager (Unified CM) software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. The vulnerability is due to insufficient input validation of certain parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting certain malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvj00512.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104448; http://www.securitytracker.com/id/1041070; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-ucm-xss
CVE: CVE-2018-0352
Published: 2018-06-07
Description: A vulnerability in the Disk Check Tool (disk-check.sh) for Cisco Wide Area Application Services (WAAS) Software could allow an authenticated, local attacker to elevate their privilege level to root. The attacker must have valid user credentials with super user privileges (level 15) to log in to the device. The vulnerability is due to insufficient validation of script files executed in the context of the Disk Check Tool. An attacker could exploit this vulnerability by replacing one script file with a malicious script file while the affected tool is running. A successful exploit could allow the attacker to gain root-level privileges and take full control of the device. Cisco Bug IDs: CSCvi72673.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264, CWE-732
References: http://www.securityfocus.com/bid/104464; http://www.securitytracker.com/id/1041077; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-waas-priv-escalation
CVE: CVE-2018-0354
Published: 2018-06-07
Description: A vulnerability in the web framework of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvf76417.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104426; http://www.securitytracker.com/id/1041067; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cuc-xss
CVE: CVE-2018-0355
Published: 2018-06-07
Description: A vulnerability in the web UI of Cisco Unified Communications Manager (Unified CM) could allow an unauthenticated, remote attacker to conduct a cross-frame scripting (XFS) attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline frames (iframes) by the web UI of the affected software. An attacker could exploit this vulnerability by persuading a user of the affected UI to navigate to an attacker-controlled web page that contains a malicious HTML iframe. A successful exploit could allow the attacker to conduct click-jacking or other client-side browser attacks on the affected system. Cisco Bug IDs: CSCvg19761.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20, CWE-1021
References: http://www.securityfocus.com/bid/104425; http://www.securitytracker.com/id/1041068; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cucm-xfs
CVE: CVE-2018-0356
Published: 2018-06-07
Description: A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvi63757.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/104421; http://www.securitytracker.com/id/1041062; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-webex-xss