deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-1727
Published: 2019-05-15
Description: A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and issue arbitrary commands to elevate the attacker's privilege level. The vulnerability is due to insufficient sanitization of user-supplied parameters that are passed to certain Python functions in the scripting sandbox of the affected device. An attacker could exploit this vulnerability to escape the scripting sandbox and execute arbitrary commands to elevate the attacker's privilege level. To exploit this vulnerability, the attacker must have local access and be authenticated to the targeted device with administrative or Python execution privileges. These requirements could limit the possibility of a successful exploit.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264, CWE-78
References: http://www.securityfocus.com/bid/108341; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-pyth-escal; http://www.securityfocus.com/bid/108341
CVE: CVE-2019-1728
Published: 2019-05-15
Description: A vulnerability in the Secure Configuration Validation functionality of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to run arbitrary commands at system boot time with the privileges of root. The vulnerability is due to a lack of proper validation of system files when the persistent configuration information is read from the file system. An attacker could exploit this vulnerability by authenticating to the device and overwriting the persistent configuration storage with malicious executable files. An exploit could allow the attacker to run arbitrary commands at system startup and those commands will run as the root user. The attacker must have valid administrative credentials for the device.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-347, CWE-347
References: http://www.securityfocus.com/bid/108391; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-conf-bypass; http://www.securityfocus.com/bid/108391
CVE: CVE-2019-1729
Published: 2019-05-15
Description: A vulnerability in the CLI implementation of a specific command used for image maintenance for Cisco NX-OS Software could allow an authenticated, local attacker to overwrite any file on the file system including system files. These file overwrites by the attacker are accomplished at the root privilege level. The vulnerability occurs because there is no verification of user-input parameters and or digital-signature verification for image files when using a specific CLI command. An attacker could exploit this vulnerability by authenticating to the device and issuing a command at the CLI. Because an exploit could allow the attacker to overwrite any file on the disk, including system files, a denial of service (DoS) condition could occur. The attacker must have valid administrator credentials for the affected device to exploit this vulnerability.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-20, CWE-347
References: http://www.securityfocus.com/bid/108378; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-file-write; http://www.securityfocus.com/bid/108378
CVE: CVE-2019-1730
Published: 2019-05-15
Description: A vulnerability in the Bash shell implementation for Cisco NX-OS Software could allow an authenticated, local attacker to bypass the limited command set of the restricted Guest Shell and execute commands at the privilege level of a network-admin user outside of the Guest Shell. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to the incorrect implementation of a CLI command that allows a Bash command to be incorrectly invoked on the Guest Shell CLI. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the Guest Shell prompt. A successful exploit could allow the attacker to issue commands that should be restricted by a Guest Shell account.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/108397; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-bash-bypass; http://www.securityfocus.com/bid/108397
CVE: CVE-2019-1731
Published: 2019-05-15
Description: A vulnerability in the SSH CLI key management functionality of Cisco NX-OS Software could allow an authenticated, local attacker to expose a user's private SSH key to all authenticated users on the targeted device. The attacker must authenticate with valid administrator device credentials. The vulnerability is due to incomplete error handling if a specific error type occurs during the SSH key export. An attacker could exploit this vulnerability by authenticating to the device and entering a crafted command at the CLI. A successful exploit could allow the attacker to expose a user's private SSH key. In addition, a similar type of error in the SSH key import could cause the passphrase-protected private SSH key to be imported unintentionally.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-200, CWE-755
References: http://www.securityfocus.com/bid/108353; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-ssh-info; http://www.securityfocus.com/bid/108353
CVE: CVE-2019-1732
Published: 2019-05-15
Description: A vulnerability in the Remote Package Manager (RPM) subsystem of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to leverage a time-of-check, time-of-use (TOCTOU) race condition to corrupt local variables, which could lead to arbitrary command injection. The vulnerability is due to the lack of a proper locking mechanism on critical variables that need to stay static until used. An attacker could exploit this vulnerability by authenticating to an affected device and issuing a set of RPM-related CLI commands. A successful exploit could allow the attacker to perform arbitrary command injection. The attacker would need administrator credentials for the targeted device.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-78, CWE-667
References: http://www.securityfocus.com/bid/108361; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-rpm-injec; http://www.securityfocus.com/bid/108361
CVE: CVE-2019-1733
Published: 2019-05-15
Description: A vulnerability in the NX API (NX-API) Sandbox interface for Cisco NX-OS Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the NX-API Sandbox interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the NX-API Sandbox interface. An attacker could exploit this vulnerability by persuading a user of the NX-API Sandbox interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected NX-API Sandbox interface.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.securityfocus.com/bid/108348; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-nxapi-xss; http://www.securityfocus.com/bid/108348
CVE: CVE-2[PII_REDACTED]
Published: 2019-05-15
Description: nanosvg library nanosvg after commit c1f6e209c16b18b46aa9f45d7e619acf42c29726 is affected by: Buffer Overflow. The impact is: Memory corruption leading to at least DoS. More severe impact vectors need more investigation. The component is: it's part of a svg processing library. function nsvg__parseColorRGB in src/nanosvg.h / line 1227. The attack vector is: It depends library usage. If input is passed from the network, then network connectivity is enough. Most likely an attack will require opening a specially crafted .svg file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: https://0day.work/cve-2[PII_REDACTED]-memory-corruption-in-nanosvg/; https://github.com/memononen/nanosvg/; https://github.com/memononen/nanosvg/issues/136
CVE: CVE-2019-11224
Published: 2019-05-15
Description: HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://blog.hivint.com/advisory-injection-dangerous-command-into-harman-amx-mvp5150-cve-2019-11224-55bea4a03f3e; https://www.amx.com/en/softwares/modero-mvp-5150-mvp-5200i-touch-panel-firmware-v2-87-13; https://blog.hivint.com/advisory-injection-dangerous-command-into-harman-amx-mvp5150-cve-2019-11224-55bea4a03f3e
CVE: CVE-2019-10640
Published: 2019-05-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.7.10, 11.8.x before 11.8.6, and 11.9.x before 11.9.4. A regex input validation issue for the .gitlab-ci.yml refs value allows Uncontrolled Resource Consumption.
CVSS Score: 7.5 (HIGH)
CWE: CWE-77
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/49665
CVE: CVE-2019-1735
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid user credentials to exploit this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108365; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1735; http://www.securityfocus.com/bid/108365
CVE: CVE-2019-1767
Published: 2019-05-15
Description: A vulnerability in the implementation of a specific CLI command for Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to cause a buffer overflow condition or perform command injection. This could allow the attacker to execute arbitrary commands with elevated privileges on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to a certain CLI command. An attacker could exploit this vulnerability by including malicious input as the argument of the affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. An attacker would need valid administrator credentials to exploit these vulnerabilities. NX-OS versions prior to 8.3(1) are affected.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119, CWE-78
References: http://www.securityfocus.com/bid/108386; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-overflow-inj; http://www.securityfocus.com/bid/108386
CVE: CVE-2019-10108
Published: 2019-05-15
Description: An Incorrect Access Control (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allowed non-members of a private project/group to add and read labels.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/56985
CVE: CVE-2019-10109
Published: 2019-05-15
Description: An Information Exposure issue (issue 1 of 2) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. EXIF geolocation data were not removed from images when uploaded to GitLab. As a result, anyone with access to the uploaded image could obtain its geolocation, device, and software version data (if present).
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/54220
CVE: CVE-2019-10110
Published: 2019-05-15
Description: An Insecure Permissions issue (issue 1 of 3) was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. The "move issue" feature may allow a user to create projects under any namespace on any GitLab instance on which they hold credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/56865
CVE: CVE-2019-10111
Published: 2019-05-15
Description: An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://about.gitlab.com/2019/04/01/security-release-gitlab-11-dot-9-dot-4-released/; https://about.gitlab.com/blog/categories/releases/; https://gitlab.com/gitlab-org/gitlab-ce/issues/56927
CVE: CVE-2019-1769
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system of an attached line card with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system of an attached line card with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108393; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-linecardinj-1769; http://www.securityfocus.com/bid/108393
CVE: CVE-2019-1770
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker with administrator credentials to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108376; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1770; http://www.securityfocus.com/bid/108376
CVE: CVE-2019-1771
Published: 2019-05-15
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/108373; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-webex-player; http://www.securityfocus.com/bid/108373
CVE: CVE-2019-1772
Published: 2019-05-15
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/108373; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-webex-player; http://www.securityfocus.com/bid/108373
CVE: CVE-2019-1773
Published: 2019-05-15
Description: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-119
References: http://www.securityfocus.com/bid/108373; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-webex-player; http://www.securityfocus.com/bid/108373
CVE: CVE-2019-1774
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108371; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1774-1775; http://www.securityfocus.com/bid/108371
CVE: CVE-2019-1775
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108371; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1774-1775; http://www.securityfocus.com/bid/108371
CVE: CVE-2019-1776
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108377; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1776; http://www.securityfocus.com/bid/108377
CVE: CVE-2019-1778
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with the privilege level of root. The vulnerability is due to insufficient validation of arguments passed to a specific CLI command on the affected device. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system with elevated privileges. An attacker would need valid administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-78, CWE-78
References: http://www.securityfocus.com/bid/108362; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-cmdinj-1778; http://www.securityfocus.com/bid/108362
CVE: CVE-2019-1779
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device with elevated privileges. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need valid device credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108394; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-fxos-cmdinj-1779; http://www.securityfocus.com/bid/108394
CVE: CVE-2019-1781
Published: 2019-05-15
Description: A vulnerability in the CLI of Cisco FXOS Software and Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker could exploit this vulnerability by including malicious input as the argument of an affected command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with elevated privileges. An attacker would need administrator credentials to exploit this vulnerability.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-77, CWE-88
References: http://www.securityfocus.com/bid/108407; https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-fxos-nxos-cmdinj-1781-1782; http://www.securityfocus.com/bid/108407