rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-6707 
A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0, 5500 Series, and 5700 Series devices and Cisco Virtualized Packet Core (VPC) Software could allow an authenticated, local attacker to break from the StarOS CLI of an affected system and execute arbitrary shell commands as a Linux root user on the system, aka Command Injection. The vulnerability exists because the affected operating system does not sufficiently sanitize commands before inserting them into Linux shell commands. An attacker could exploit this vulnerability by submitting a crafted CLI command for execution in a Linux shell command as a root user. Cisco Bug IDs: CSCvc69329, CSCvc72930.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Cisco StarOS
Published: 2017-07-06T00:00:00.000Z
CVE-2017-6708 
A vulnerability in the symbolic link (symlink) creation functionality of the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to read sensitive files or execute malicious code on an affected system. The vulnerability is due to the absence of validation checks for the input that is used to create symbolic links. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76654.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Cisco Ultra Services Framework
Published: 2017-07-06T00:00:00.000Z
CVE-2017-6709 
A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials for Cisco Elastic Services Controller (ESC) and Cisco OpenStack deployments in an affected system. The vulnerability exists because the affected software logs administrative credentials in clear text for Cisco ESC and Cisco OpenStack deployment purposes. An attacker could exploit this vulnerability by accessing the AutoVNF URL for the location where the log files are stored and subsequently accessing the administrative credentials that are stored in clear text in those log files. This vulnerability affects all releases of the Cisco Ultra Services Framework prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76659.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Cisco Ultra Services Framework
Published: 2017-07-06T00:00:00.000Z
CVE-2017-6710 
A vulnerability in the Cisco Virtual Network Function (VNF) Element Manager could allow an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The vulnerability is due to command settings that allow Cisco VNF Element Manager users to specify arbitrary commands that will run as root on the server. An attacker could use this setting to elevate privileges and run commands in the context of the root user on the server. Cisco Bug IDs: CSCvc76670. Known Affected Releases: prior to 5.0.4 and 5.1.4.
Problem types: description: Arbitrary Command Execution
Affected products: vendor: Cisco Systems, Inc.
product: Virtual Network Function (VNF) Element Manager
Published: 2017-08-17T20:00:00.000Z
CVE-2017-6711 
A vulnerability in the Ultra Automation Service (UAS) of the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to gain unauthorized access to a targeted device. The vulnerability is due to an insecure default configuration of the Apache ZooKeeper service used by the affected software. An attacker could exploit this vulnerability by accessing the affected device through the orchestrator network. An exploit could allow the attacker to gain access to ZooKeeper data nodes (znodes) and influence the behavior of the system's high-availability feature. This vulnerability affects all releases of Cisco Ultra Services Framework UAS prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvd29395.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: Cisco Ultra Services Framework
Published: 2017-07-06T00:00:00.000Z
CVE-2017-6712 
A vulnerability in certain commands of Cisco Elastic Services Controller could allow an authenticated, remote attacker to elevate privileges to root and run dangerous commands on the server. The vulnerability occurs because a "tomcat" user on the system can run certain shell commands, allowing the user to overwrite any file on the filesystem and elevate privileges to root. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76634.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Cisco Elastic Services Controller
Published: 2017-07-06T00:00:00.000Z
CVE-2017-6713 
A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access to the affected system. The vulnerability is due to static, default credentials for the Cisco ESC UI that are shared between installations. An attacker who can extract the static credentials from an existing installation of Cisco ESC could generate an admin session token that allows access to all instances of the ESC web UI. This vulnerability affects Cisco Elastic Services Controller prior to releases 2.3.1.434 and 2.3.2. Cisco Bug IDs: CSCvc76627.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: n/a
product: Cisco Elastic Services Controller
Published: 2017-07-06T00:00:00.000Z
CVE-2017-6714 
A vulnerability in the AutoIT service of Cisco Ultra Services Framework Staging Server could allow an unauthenticated, remote attacker to execute arbitrary shell commands as the Linux root user. The vulnerability is due to improper shell invocations. An attacker could exploit this vulnerability by crafting CLI command inputs to execute Linux shell commands as the root user. This vulnerability affects all releases of Cisco Ultra Services Framework Staging Server prior to Releases 5.0.3 and 5.1. Cisco Bug IDs: CSCvc76673.
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: n/a
product: Cisco Ultra Services Framework
Published: 2017-07-06T00:00:00.000Z
CVE-2017-6715 
A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. Affected Products: Cisco Firepower Management Center Releases 5.4.1.x and prior. More Information: CSCuy88951. Known Affected Releases: 5.4.1.6.
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: Cisco Firepower Management Center
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6716 
A vulnerability in the web framework code of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. Affected Products: Cisco Firepower Management Center Software Releases prior to 6.0.0.0. More Information: CSCuy88785. Known Affected Releases: 5.4.1.6.
Problem types: description: Stored Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: Cisco Firepower Management Center
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6717 
A vulnerability in the web framework of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface. More Information: CSCvc38801. Known Affected Releases: 6.0.1.3 6.2.1. Known Fixed Releases: 6.2.1.
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: Cisco Firepower Management Center
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6718 
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges to the root level. More Information: CSCvb99384. Known Affected Releases: 6.2.1.BASE. Known Fixed Releases: 6.2.11.3i.ROUT 6.2.1.29i.ROUT 6.2.1.26i.ROUT.
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: Cisco IOS XR
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6719 
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with root privileges, aka Command Injection. More Information: CSCvb99406. Known Affected Releases: 6.2.1.BASE. Known Fixed Releases: 6.2.1.28i.BASE 6.2.1.22i.BASE 6.1.32.8i.BASE 6.1.31.3i.BASE 6.1.3.10i.BASE.
Problem types: description: Local Command Injection Vulnerability
Affected products: vendor: n/a
product: Cisco IOS XR
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6720 
A vulnerability in the Secure Shell (SSH) subsystem of Cisco Small Business Managed Switches software could allow an authenticated, remote attacker to cause a reload of the affected switch, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SSH connections. An attacker could exploit this vulnerability by logging in to an affected switch via SSH and sending a malicious SSH message. This vulnerability affects the following Cisco products when SSH is enabled: Small Business 300 Series Managed Switches, Small Business 500 Series Stackable Managed Switches, 350 Series Managed Switches, 350X Series Stackable Managed Switches, 550X Series Stackable Managed Switches, ESW2 Series Advanced Switches. Cisco Bug IDs: CSCvb48377.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: Cisco Small Business Managed Switches
Published: 2017-09-21T05:00:00.000Z
CVE-2017-6721 
A vulnerability in the ingress processing of fragmented TCP packets by Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause the WAASNET process to restart unexpectedly, causing a denial of service (DoS) condition. More Information: CSCvc57428. Known Affected Releases: 6.3(1). Known Fixed Releases: 6.3(0.143) 6.2(3c)6 6.2(3.22).
Problem types: description: TCP Fragment Denial of Service Vulnerability
Affected products: vendor: n/a
product: Cisco Wide Area Application Services
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6722 
A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) service of Cisco Unified Contact Center Express (UCCx) could allow an unauthenticated, remote attacker to masquerade as a legitimate user, aka a Clear Text Authentication Vulnerability. More Information: CSCuw86638. Known Affected Releases: 10.6(1). Known Fixed Releases: 11.5(1.10000.61).
Problem types: description: Clear Text Authentication Vulnerability
Affected products: vendor: n/a
product: Cisco Unified Contact Center Express
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6724 
A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCuw65843. Known Affected Releases: 3.1(0.0).
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: Cisco Prime Infrastructure
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6725 
A vulnerability in the web framework code of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCuw65833 CSCuw65837. Known Affected Releases: 2.2(2).
Problem types: description: Cross-Site Scripting Vulnerabilities
Affected products: vendor: n/a
product: Cisco Prime Infrastructure
Published: 2017-07-04T00:00:00.000Z
CVE-2017-6726 
A vulnerability in the CLI of the Cisco Prime Network Gateway could allow an authenticated, local attacker to retrieve system process information, which could lead to the disclosure of confidential information. More Information: CSCvd59341. Known Affected Releases: 4.2(1.0)P1.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: Cisco Prime Network Gateway
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6727 
A vulnerability in the Server Message Block (SMB) protocol of Cisco Wide Area Application Services (WAAS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device due to a process restarting unexpectedly and creating Core Dump files. More Information: CSCvc63035. Known Affected Releases: 6.2(3a). Known Fixed Releases: 6.3(0.167) 6.2(3c)5 6.2(3.22).
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: n/a
product: Cisco Wide Area Application Services
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6728 
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privilege level on an affected system, because of Incorrect Permissions. More Information: CSCvb99389. Known Affected Releases: 6.2.1.BASE. Known Fixed Releases: 6.3.1.15i.BASE 6.2.3.1i.BASE 6.2.2.15i.BASE 6.1.4.10i.BASE.
Problem types: description: Incorrect Permissions Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: Cisco IOS XR
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6729 
A vulnerability in the Border Gateway Protocol (BGP) processing functionality of the Cisco StarOS operating system for Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core (VPC) Software could allow an unauthenticated, remote attacker to cause the BGP process on an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability affects the following products if they are running the Cisco StarOS operating system and BGP is enabled for the system: Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core Software. More Information: CSCvc44968. Known Affected Releases: 16.4.1 19.1.0 21.1.0 21.1.M0.65824. Known Fixed Releases: 21.3.A0.65902 21.2.A0.65905 21.1.b0.66164 21.1.V0.66014 21.1.R0.65898 21.1.M0.65894 21.1.0.66030 21.1.0.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: n/a
product: Cisco StarOS
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6730 
A vulnerability in the web-based GUI of Cisco Wide Area Application Services (WAAS) Central Manager could allow an unauthenticated, remote attacker to retrieve completed reports from an affected system, aka Information Disclosure. This vulnerability affects the following products if they are running an affected release of Cisco Wide Area Application Services (WAAS) Software and are configured to use the Central Manager function: Cisco Virtual Wide Area Application Services (vWAAS), Cisco Wide Area Application Services (WAAS) Appliances, Cisco Wide Area Application Services (WAAS) Modules. Only Cisco WAAS products that are configured with the Central Manager role are affected by this vulnerability. More Information: CSCvd87574. Known Affected Releases: 4.4(7) 6.2(1) 6.2(3). Known Fixed Releases: 6.3(0.228) 6.3(0.226) 6.2(3d)8 5.5(7b)17.
Problem types: description: Information Disclosure Vulnerability
Affected products: vendor: n/a
product: Cisco Wide Area Application Services
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6731 
A vulnerability in Multicast Source Discovery Protocol (MSDP) ingress packet processing for Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the MSDP session to be unexpectedly reset, causing a short denial of service (DoS) condition. The MSDP session will restart within a few seconds. More Information: CSCvd94828. Known Affected Releases: 4.3.2.MCAST 6.0.2.BASE. Known Fixed Releases: 6.3.1.19i.MCAST 6.2.3.1i.MCAST 6.2.2.17i.MCAST 6.1.4.12i.MCAST.
Problem types: description: Denial of Service Vulnerability
Affected products: vendor: n/a
product: Cisco IOS XR
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6732 
A vulnerability in the installation procedure for Cisco Prime Network Software could allow an authenticated, local attacker to elevate their privileges to root privileges. More Information: CSCvd47343. Known Affected Releases: 4.2(2.1)PP1 4.2(3.0)PP6 4.3(0.0)PP4 4.3(1.0)PP2. Known Fixed Releases: 4.3(2).
Problem types: description: Privilege Escalation Vulnerability
Affected products: vendor: n/a
product: Cisco Prime Network
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6733 
A vulnerability in the web-based application interface of the Cisco Identity Services Engine (ISE) portal could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvd87482. Known Affected Releases: 2.1(102.101) 2.2(0.283) 2.3(0.151).
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: Cisco Identity Services Engine
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6734 
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device, related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800).
Problem types: description: Cross-Site Scripting Vulnerability
Affected products: vendor: n/a
product: Cisco Identity Services Engine
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6735 
A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated, local attacker to execute arbitrary code on a targeted system. More Information: CSCvc91092. Known Affected Releases: 6.2.0 6.2.1.
Problem types: description: Arbitrary Code Execution Vulnerability
Affected products: vendor: n/a
product: Cisco FireSIGHT System Software
Published: 2017-07-10T20:00:00.000Z
CVE-2017-6736 
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities.
 The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.
 Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable.
   There are workarounds that address these vulnerabilities.
Problem types: cwe_id: CWE-119
description: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Cisco
product: IOS
vendor: IntelliShield
product: Universal Product
Published: 2017-07-17T21:00:00.000Z
CVE-2017-6737 
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.&nbsp;



The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.



Only traffic directed to the affected system can be used to exploit this vulnerability.
Problem types: cwe_id: CWE-119
description: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Cisco
product: IOS
Published: 2017-07-17T21:00:00.000Z
CVE-2017-6738 
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities.
 The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP - Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. A successful exploit could allow the attacker to execute arbitrary code and obtain full control of the affected system or cause the affected system to reload.
 Customers are advised to apply the workaround as contained in the Workarounds section below. Fixed software information is available via the Cisco IOS Software Checker. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable.
   There are workarounds that address these vulnerabilities.
Problem types: cwe_id: CWE-119
description: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: Cisco
product: IOS
vendor: Cisco
product: Cisco IOS XE Software
Published: 2017-07-17T21:00:00.000Z
CVE-2017-6739 
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.&nbsp;



The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.



Only traffic directed to the affected system can be used to exploit this vulnerability.
Problem types: cwe_id: CWE-119
description: Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: IntelliShield
product: Universal Product
Published: 2017-07-17T21:00:00.000Z