rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-15396 Cisco Unity Connection File Upload Denial of Service Vulnerability
A vulnerability in the Bulk Administration Tool (BAT) for Cisco Unity Connection could allow an authenticated, remote attacker to cause high disk utilization, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software does not restrict the maximum size of certain files that can be written to disk. An attacker who has valid administrator credentials for an affected system could exploit this vulnerability by sending a crafted, remote connection request to an affected system. A successful exploit could allow the attacker to write a file that consumes most of the available disk space on the system, causing application functions to operate abnormally and leading to a DoS condition.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Unity Connection
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15397 Cisco Adaptive Security Appliance IPsec VPN Denial of Service Vulnerability
A vulnerability in the implementation of Traffic Flow Confidentiality (TFC) over IPsec functionality in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to restart unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to an error that may occur if the affected software renegotiates the encryption key for an IPsec tunnel when certain TFC traffic is in flight. An attacker could exploit this vulnerability by sending a malicious stream of TFC traffic through an established IPsec tunnel on an affected device. A successful exploit could allow the attacker to cause a daemon process on the affected device to crash, which could cause the device to crash and result in a DoS condition.
Problem types: cwe_id: CWE-320
description: CWE-320
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15398 Cisco Adaptive Security Appliance Access Control List Bypass Vulnerability
A vulnerability in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass an access control list (ACL) that is configured for an interface of an affected device. The vulnerability is due to errors that could occur when the affected software constructs and applies per-user-override rules. An attacker could exploit this vulnerability by connecting to a network through an affected device that has a vulnerable configuration. A successful exploit could allow the attacker to access resources that are behind the affected device and would typically be protected by the interface ACL.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15399 Cisco Adaptive Security Appliance TCP Syslog Denial of Service Vulnerability
A vulnerability in the TCP syslog module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust the 1550-byte buffers on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to a missing boundary check in an internal function. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between an affected device and its configured TCP syslog server and then maliciously modifying the TCP header in segments that are sent from the syslog server to the affected device. A successful exploit could allow the attacker to exhaust buffer on the affected device and cause all TCP-based features to stop functioning, resulting in a DoS condition. The affected TCP-based features include AnyConnect SSL VPN, clientless SSL VPN, and management connections such as Secure Shell (SSH), Telnet, and HTTPS.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15400 Cisco Cloud Services Platform 2100 Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Cloud Services Platform 2100
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15401 Cisco Hosted Collaboration Mediation Fulfillment Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Hosted Collaboration Mediation Fulfillment could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system via a web browser and with the privileges of the user.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Cisco
product: Cisco Hosted Collaboration Mediation Fulfillment
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15402 Cisco Enterprise NFV Infrastructure Software Cross-Site Request Forgery Vulnerability
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to conduct cross-site request forgery (CSRF) attacks. The vulnerability is due to improper validation of Origin headers on HTTP requests within the management interface. An attacker could exploit this vulnerability by convincing a targeted user to follow a URL to a malicious website. An exploit could allow the attacker to take actions within the software with the privileges of the targeted user or gain access to sensitive information.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Cisco
product: Cisco Enterprise NFV Infrastructure Software
Published: 2018-10-17T20:00:00.000Z
CVE-2018-15403 Multiple Cisco Unified Communications Products Open Redirect Vulnerability
A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: Cisco
product: Cisco Emergency Responder
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15404 Cisco Integrated Management Controller Supervisor and Cisco UCS Director System Resources Denial of Service Vulnerability
A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to cause a denial of service (DoS) condition on an affected system. The vulnerability is due to insufficient restrictions on the size or total amount of resources allowed via the web interface. An attacker who has valid credentials for the application could exploit this vulnerability by sending a crafted or malformed HTTP request to the web interface. A successful exploit could allow the attacker to cause oversubscription of system resources or cause a component to become unresponsive, resulting in a DoS condition.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Unified Computing System Director
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15405 Cisco Integrated Management Controller Supervisor and Cisco UCS Director Authenticated Web Interface Information Disclosure Vulnerability
A vulnerability in the web interface for specific feature sets of Cisco Integrated Management Controller (IMC) Supervisor and Cisco UCS Director could allow an authenticated, remote attacker to access sensitive information. The vulnerability is due to an authorization check that does not properly include the access level of the web interface user. An attacker who has valid application credentials could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to view sensitive information that belongs to other users. The attacker could then use this information to conduct additional reconnaissance attacks.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: Cisco
product: Cisco Unified Computing System Director
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15406 Cisco UCS Director Stored Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco UCS Director could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive, browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Unified Computing System Director
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15407 Cisco HyperFlex World-Readable Sensitive Information Vulnerability
A vulnerability in the installation process of Cisco HyperFlex Software could allow an authenticated, local attacker to read sensitive information. The vulnerability is due to insufficient cleanup of installation files. An attacker could exploit this vulnerability by accessing the residual installation files on an affected system. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Cisco
product: Cisco HyperFlex HX-Series
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15408 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15409 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15410 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15411 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15412 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15413 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15414 Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx ARF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15415 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15416 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15417 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15418 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15419 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15420 Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15421 Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities
A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco WebEx ARF Player
Published: 2018-10-05T14:00:00.000Z