rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1203 
In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, the tcpdump binary, being run with sudo, may potentially be used by compadmin to execute arbitrary code with root privileges.
Problem types: description: Incorrect Authorization vulnerability
Affected products: vendor: Dell EMC
product: Isilon OneFS
Published: 2018-03-26T18:00:00.000Z
CVE-2018-1204 
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious compadmin may potentially exploit this vulnerability to execute arbitrary code with root privileges.
Problem types: description: Path Traversal vulnerability
Affected products: vendor: Dell EMC
product: Isilon OneFS
Published: 2018-03-26T18:00:00.000Z
CVE-2018-1205 
Dell EMC ScaleIO, versions prior to 2.5, do not properly handle some packet data in the MDM service. As a result, a remote attacker could potentially send specifically crafted packet data to the MDM service causing it to crash.
Problem types: description: Buffer overflow vulnerability
Affected products: vendor: Dell EMC
product: ScaleIO
Published: 2018-03-27T21:00:00.000Z
CVE-2018-1206 
Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110 contain a hardcoded database account with administrative privileges. The affected account is "apollosuperuser." An attacker with local access to the server where DPA Datastore Service is installed and knowledge of the password may potentially gain unauthorized access to the database. Note: The Datastore Service database cannot be accessed remotely using this account.
Problem types: description: Hardcoded Password Vulnerability
Affected products: vendor: n/a
product: Dell EMC Data Protection Advisor versions prior to 6.3 Patch 159 and Dell EMC Data Protection Advisor versions prior to 6.4 Patch 110
Published: 2018-03-12T17:00:00.000Z
CVE-2018-1207 
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code. A remote unauthenticated attacker may potentially be able to use CGI variables to execute remote code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-23T14:00:00.000Z
CVE-2018-1211 
Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain a path traversal vulnerability in its Web server's URI parser which could be used to obtain specific sensitive data without authentication. A remote unauthenticated attacker may be able to read configuration settings from the iDRAC by querying specific URI strings.
Problem types: description: path traversal vulnerability
Affected products: vendor: Dell EMC
product: iDRAC7/iDRAC8
Published: 2018-03-23T14:00:00.000Z
CVE-2018-1212 Authenticated remote code execution in iDRAC 6
The web-based diagnostics console in Dell EMC iDRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A remote authenticated malicious iDRAC user with access to the diagnostics console could potentially exploit this vulnerability to execute arbitrary commands as root on the affected iDRAC system.
Problem types: description: Authenticated remote code execution command injection vulnerability.
Affected products: vendor: Dell EMC
product: iDRAC6 (Monolithic)
vendor: Dell EMC
product: iDRAC6 (Modular)
Credits: lang: en
value: Dell EMC would like to thank Arseniy for reporting this issue to us.
Published: 2018-07-02T17:00:00.000Z
CVE-2018-1213 
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, versions 7.2.1.x, and version 7.1.1.11 and 8.1.0.2 is affected by a cross-site request forgery vulnerability. A malicious user may potentially exploit this vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application.
Problem types: description: Cross-Site Request Forgery Vulnerability
Affected products: vendor: Dell EMC
product: Isilon OneFS
Published: 2018-03-26T18:00:00.000Z
CVE-2018-1214 
Dell EMC SupportAssist Enterprise version 1.1 creates a local Windows user account named "OMEAdapterUser" with a default password as part of the installation process. This unnecessary user account also remains even after an upgrade from v1.1 to v1.2. Access to the management console can be achieved by someone with knowledge of the default password. If SupportAssist Enterprise is installed on a server running OpenManage Essentials (OME), the OmeAdapterUser user account is added as a member of the OmeAdministrators group for the OME. An unauthorized person with knowledge of the default password and access to the OME web console could potentially use this account to gain access to the affected installation of OME with OmeAdministrators privileges. This is fixed in version 1.2.1.
Problem types: description: undocumented default account
Affected products: vendor: n/a
product: Dell SupportAssist Enterprise version 1.1
Published: 2018-02-12T21:00:00.000Z
CVE-2018-1215 
An arbitrary file upload vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). A remote authenticated malicious user may potentially upload arbitrary maliciously crafted files in any location on the web server. By chaining this vulnerability with CVE-2018-1216, the attacker may use the default account to exploit this vulnerability.
Problem types: description: Arbitrary file upload vulnerability
Affected products: vendor: n/a
product: vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement)
Published: 2018-03-08T15:00:00.000Z
CVE-2018-1216 
A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). They contain an undocumented default account (smc) with a hard-coded password that may be used with certain web servlets. A remote attacker with the knowledge of the hard-coded password and the message format may use vulnerable servlets to gain unauthorized access to the system. Note: This account cannot be used to log in via the web user interface.
Problem types: description: Hard-coded password vulnerability
Affected products: vendor: n/a
product: vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement)
Published: 2018-03-08T15:00:00.000Z
CVE-2018-1217 
Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials.
Problem types: description: Missing Access Control Vulnerability
Affected products: vendor: Dell EMC
product: Avamar, Integrated Data Protection Appliance
Published: 2018-04-09T20:00:00.000Z
CVE-2018-1218 
In Dell EMC NetWorker versions prior to 9.2.1.1, versions prior to 9.1.1.6, 9.0.x, and versions prior to 8.2.4.11, the 'nsrd' daemon causes a buffer overflow condition when handling certain messages. A remote unauthenticated attacker could potentially exploit this vulnerability to cause a denial of service to the users of NetWorker systems.
Problem types: description: Buffer Overflow Vulnerability
Affected products: vendor: Dell EMC
product: Dell EMC NetWorker
Published: 2018-03-19T18:00:00.000Z
CVE-2018-1219 
EMC RSA Archer, versions prior to 6.2.0.8, contains an improper access control vulnerability on an API which is used to enumerate user information. A remote authenticated malicious user can potentially exploit this vulnerability to gather information about the user base and may use this information in subsequent attacks.
Problem types: description: Improper Access Control
Affected products: vendor: n/a
product: EMC RSA Archer GRC Platform RSA Archer versions prior to 6.2.0.8
Published: 2018-03-08T15:00:00.000Z
CVE-2018-1220 
EMC RSA Archer, versions prior to 6.2.0.8, contains a redirect vulnerability in the QuickLinks feature. A remote attacker may potentially exploit this vulnerability to redirect genuine users to phishing websites with the intent of obtaining sensitive information from the users.
Problem types: description: URL Redirection to Untrusted Site
Affected products: vendor: n/a
product: EMC RSA Archer GRC Platform RSA Archer versions prior to 6.2.0.8
Published: 2018-03-08T15:00:00.000Z
CVE-2018-1221 
In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service.
Problem types: description: websocket handling vulnerability
Affected products: vendor: Dell EMC
product: The Cloud Foundry Gorouter
Published: 2018-03-19T18:00:00.000Z
CVE-2018-1223 
Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the ability to read the application logs could use these credentials to escalate privileges.
Problem types: description: Credential leak to logs
Affected products: vendor: Cloud Foundry
product: Container Runtime
Published: 2018-09-17T16:00:00.000Z
CVE-2018-1227 
Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal. The original domain for the Concourse CI (concourse-dot-ci) open source project has been registered by an unknown actor, and is therefore no longer the official website for Concourse CI. The new official domain is concourse-ci.org. At approximately 4 am EDT on March 7, 2018 the Concourse OSS team began receiving reports that the Concourse domain was not responding. The Concourse OSS team discovered, upon investigation with both the original and the new domain registrars, that the originating domain registrar had made the domain available for purchase. This was done despite the domain being renewed by the Concourse OSS team through August 2018. For a customer to be affected, they would have needed to access a download from a "concourse-dot-ci" domain web site after March 6, 2018 18:00:00 EST. Accessing that domain is NOT recommended by Pivotal. Anyone who had been using that domain should immediately begin using the concourse-ci.org domain instead. Customers can also safely access Concourse software from the traditionally available locations on the Pivotal Network or GitHub.
Problem types: description: Domain Issue
Affected products: vendor: n/a
product: Concourse CI: As of 2018-03-13, Pivotal does not believe that any resources or builds of Concourse have been compromised.
Published: 2018-03-13T20:00:00.000Z
CVE-2018-1229 
Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.
Problem types: cwe_id: CWE-79
description: CWE-79 - Cross-site Scripting (XSS) - Stored
Affected products: vendor: Spring by Pivotal
product: Spring Batch Admin
Published: 2018-03-21T20:00:00.000Z
CVE-2018-1230 
Pivotal Spring Batch Admin, all versions, does not contain cross site request forgery protection. A remote unauthenticated user could craft a malicious site that executes requests to Spring Batch Admin. This issue has not been patched because Spring Batch Admin has reached end of life.
Problem types: cwe_id: CWE-352
description: CWE-352 - Cross-Site Request Forgery (CSRF)
Affected products: vendor: Spring by Pivotal
product: Spring Batch Admin
Published: 2018-03-21T20:00:00.000Z
CVE-2018-1231 
Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. A user with access to an instance using the BOSH CLI can access the BOSH CLI configuration file and use its contents to perform authenticated requests to BOSH.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-03-27T16:00:00.000Z
CVE-2018-1232 
RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are impacted by a stack-based buffer overflow which may occur when handling certain malicious web cookies that have invalid formats. The attacker could exploit this vulnerability to crash the authentication agent and cause a denial-of-service situation.
Problem types: description: Stack-based Buffer Overflow Vulnerability
Affected products: vendor: Dell EMC
product: RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server
Published: 2018-03-30T21:00:00.000Z
CVE-2018-1233 
RSA Authentication Agent version 8.0.1 and earlier for Web for both IIS and Apache Web Server are affected by a cross-site scripting vulnerability. The attackers could potentially exploit this vulnerability to execute arbitrary HTML or JavaScript code in the user's browser session in the context of the affected website.
Problem types: description: Cross-site Scripting Vulnerability
Affected products: vendor: Dell EMC
product: RSA Authentication Agent for Web for IIS, RSA Authentication Agent for Web for Apache Web Server
Published: 2018-03-30T21:00:00.000Z
CVE-2018-1234 
RSA Authentication Agent version 8.0.1 and earlier for Web for IIS is affected by a problem where access control list (ACL) permissions on a Windows Named Pipe were not sufficient to prevent access by unauthorized users. The attacker with local access to the system can exploit this vulnerability to read configuration properties for the authentication agent.
Problem types: description: Sensitive Information Disclosure Vulnerability
Affected products: vendor: Dell EMC
product: RSA Authentication Agent for Web for IIS
Published: 2018-03-30T21:00:00.000Z
CVE-2018-1235 
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege.
Problem types: description: command injection vulnerability
Affected products: vendor: Dell EMC
product: Dell EMC RecoverPoint
vendor: Dell EMC
product: Dell EMC RecoverPoint Virtual Machine (VM)
Published: 2018-05-29T17:00:00.000Z
CVE-2018-1237 
Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having network access to LIA, could potentially exploit this vulnerability to launch brute force guessing of user names and passwords of user accounts on the LIA.
Problem types: description: Improper Restriction of Excessive Authentication Attempts Vulnerability
Affected products: vendor: Dell EMC
product: ScaleIO
Published: 2018-03-27T21:00:00.000Z
CVE-2018-1238 
Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge of the LIA administrative password, could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed.
Problem types: description: Command injection vulnerability
Affected products: vendor: Dell EMC
product: ScaleIO
Published: 2018-03-27T21:00:00.000Z
CVE-2018-1239 
Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed.
Problem types: description: OS command injection vulnerabilities
Affected products: vendor: Dell EMC
product: Unity Operating Environment (OE)
Published: 2018-05-08T13:00:00.000Z
CVE-2018-1240 
Dell EMC ViPR Controller, versions after 3.0.0.38, contain an information exposure vulnerability in the VRRP. VRRP defaults to an insecure configuration in Linux's keepalived component which sends the cluster password in plaintext through multicast. A malicious user, having access to the vCloud subnet where ViPR is deployed, could potentially sniff the password and use it to take over the cluster's virtual IP and cause a denial of service on that ViPR Controller system.
Problem types: description: Information Exposure Vulnerability
Affected products: vendor: Dell EMC
product: ViPR Controller
Published: 2018-04-18T16:00:00.000Z
CVE-2018-1241 
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-text into the RecoverPoint log file. An authenticated malicious user with access to the RecoverPoint log files may obtain the exposed LDAP password to use it in further attacks.
Problem types: cwe_id: CWE-532
description: CWE-532: Information Exposure Through Log Files
Affected products: vendor: Dell EMC
product: Dell EMC RecoverPoint
vendor: Dell EMC
product: Dell EMC RecoverPoint Virtual Machine (VM)
Published: 2018-05-29T17:00:00.000Z
CVE-2018-1242 
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read.
Problem types: description: command injection vulnerability
Affected products: vendor: Dell EMC
product: Dell EMC RecoverPoint
vendor: Dell EMC
product: Dell EMC RecoverPoint Virtual Machine (VM)
Published: 2018-05-29T17:00:00.000Z
CVE-2018-1243 iDRAC6/iDRAC7/iDRAC8 - Weak CGI session ID vulnerability
Dell EMC iDRAC6, versions prior to 2.91, iDRAC7/iDRAC8, versions prior to 2.60.60.60 and iDRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform bruteforce session guessing attacks.
Problem types: description: Weak CGI session ID vulnerability.
Affected products: vendor: Dell EMC
product: iDRAC6
vendor: Dell EMC
product: iDRAC7
vendor: Dell EMC
product: iDRAC8
Credits: lang: en
value: Dell EMC would like to thank Check Point Software Technologies Ltd. for reporting the issue to us.
Published: 2018-07-02T17:00:00.000Z
CVE-2018-1244 iDRAC7/iDRAC8/iDrac9 contains a command injection vulnerability in the SNMP agent.
Dell EMC iDRAC7/iDRAC8, versions prior to 2.60.60.60, and iDRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious iDRAC user with configuration privileges could potentially exploit this vulnerability to execute arbitrary commands on the iDRAC where SNMP alerting is enabled.
Problem types: description: Command injection vulnerability in the SNMP agent.
Affected products: vendor: Dell EMC
product: iDRAC7
vendor: Dell EMC
product: iDRAC8
vendor: Dell EMC
product: iDRAC9
Published: 2018-07-02T17:00:00.000Z
CVE-2018-1245 Authorization ByPass Vulnerability
RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 and 7.1.0 contains an authorization bypass vulnerability within the workflow architect component (ACM). A remote authenticated malicious user with non-admin privileges could potentially bypass the Java Security Policies. Once bypassed, a malicious user could potentially run arbitrary system commands at the OS level with application owner privileges on the affected system.
Problem types: description: Authorization ByPass Vulnerability
Affected products: vendor: RSA
product: RSA Identity Governance and Lifecycle
Published: 2018-07-13T17:00:00.000Z
CVE-2018-1246 
Dell EMC Unity and UnityVSA contains reflected cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or Java Script code to Unisphere, which is then reflected back to the victim and executed by the web browser.
Problem types: description: Reflected Cross-site Scripting (XSS)
Affected products: vendor: Dell EMC
product: Dell EMC Unity
vendor: Dell EMC
product: Dell EMC UnityVSA
Published: 2018-09-28T18:00:00.000Z
CVE-2018-1247 
RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin users to cause a denial of service or extract server data via injecting a maliciously crafted DTD in an XML file submitted to the application.
Problem types: description: XML External Entity Injection Vulnerability
Affected products: vendor: Dell EMC
product: RSA Authentication Manager Security Console
Published: 2018-05-08T13:00:00.000Z
CVE-2018-1248 
RSA Authentication Manager Security Console, Operation Console and Self-Service Console, version 8.3 and earlier, is affected by a Host header injection vulnerability. This could allow a remote attacker to potentially poison HTTP cache and subsequently redirect users to arbitrary web domains.
Problem types: description: Host Header Injection Vulnerability
Affected products: vendor: Dell EMC
product: RSA Authentication Manager Security Console, Operation Console and Self-Service Console
Published: 2018-05-08T13:00:00.000Z
CVE-2018-1249 iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs
Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.
Problem types: description: SSL Strip Vulnerability
Affected products: vendor: Dell EMC
product: iDRAC9
Published: 2018-07-02T17:00:00.000Z