rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-3761 
The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution.
Problem types: description: Remote code execution
Affected products: vendor: Lenovo Group Ltd.
product: Service Framework application
Published: 2017-10-17T20:00:00.000Z
CVE-2017-3762 
Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system in which it is installed.
Problem types: description: Privilege Escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo Fingerprint Manager Pro
Published: 2018-01-26T01:00:00.000Z
CVE-2017-3763 
An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts in LXCA versions earlier than 1.3.2.
Problem types: description: Credential disclosure
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo XClarity Administrator (LXCA)
Published: 2017-09-22T14:00:00.000Z
CVE-2017-3764 
A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthenticated users with access to the LXCA web user interface. No password information of the user accounts is exposed.
Problem types: description: Unauthenticated User Enumeration
Affected products: vendor: Lenovo Group Ltd.
product: xClarity Administrator
Published: 2017-11-30T19:00:00.000Z
CVE-2017-3765 
In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when performing local authentication under specific circumstances. If exploited, admin-level access to the switch is granted.
Problem types: description: Authentication Bypass
Affected products: vendor: Lenovo Group Ltd.
product: Enterprise Network Operating System affecting Lenovo and IBM RackSwitch and BladeCenter Products
Published: 2018-01-10T18:00:00.000Z
CVE-2017-3767 
A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacker with local privileges could execute code with administrative privileges.
Problem types: description: Local priviledge escalation
Affected products: vendor: Lenovo Group Ltd.
product: Realtek Audio Driver
Published: 2017-11-13T16:00:00.000Z
CVE-2017-3768 
An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x). Flooding the IMM2 with a high volume of authentication failures via the Common Information Model (CIM) used by LXCA and OneCLI and other tools can exhaust available system memory which can cause the IMM2 to reboot itself until the requests cease.
Problem types: description: Denial of Service
Affected products: vendor: Lenovo Group Ltd.
product: Integrated Management Module 2 (IMM2)
Published: 2018-01-26T19:00:00.000Z
CVE-2017-3770 
Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interface functionality to execute privileged commands within the underlying LXCA operating system.
Problem types: description: Privilege Escalation
Affected products: vendor: Lenovo Group Ltd.
product: Lenovo XClarity Administrator (LXCA)
Published: 2017-09-22T14:00:00.000Z
CVE-2017-3771 
System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI initialization process.
Problem types: description: Unauthorized bootloader allowed to run during system boot, reducing protection against rootkits
Affected products: vendor: Lenovo Group Ltd.
product: E95, ThinkCentre M710s/M710t
Published: 2017-10-26T17:00:00.000Z
CVE-2017-3772 
A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Lenovo
product: PC Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Xiao Xuedong for reporting this issue.
Published: 2024-07-31T20:30:38.174Z
CVE-2017-3774 
A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers and earlier than version 6.60 used in some IBM servers. An attacker providing a crafted user ID and password combination can cause a portion of the authentication routine to overflow its stack, resulting in stack corruption.
Problem types: description: Stack overflow leading to memory corruption
Affected products: vendor: Lenovo Group Ltd.
product: IMM2
vendor: IBM
product: IMM2
Published: 2018-04-19T14:00:00.000Z
CVE-2017-3775 
Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.
Problem types: description: Booting unauthenticated code
Affected products: vendor: Lenovo Group Ltd.
product: Some Lenovo Flex System and Lenovo System x products
Published: 2018-05-04T16:00:00.000Z
CVE-2017-3776 
Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting others observing the channel to potentially see this information.
Problem types: description: Cleartext transmission of information
Affected products: vendor: Lenovo Group Ltd.
product: Help mobile Android app
Published: 2018-04-19T14:00:00.000Z
CVE-2017-3790 
A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software could allow an unauthenticated, remote attacker to cause a reload of the affected system, resulting in a denial of service (DoS) condition. The vulnerability is due to insufficient size validation of user-supplied data. An attacker could exploit this vulnerability by sending crafted H.224 data in Real-Time Transport Protocol (RTP) packets in an H.323 call. An exploit could allow the attacker to overflow a buffer in a cache that belongs to the received packet parser, which will result in a crash of the application, resulting in a DoS condition. All versions of Cisco Expressway Series Software and Cisco TelePresence VCS Software prior to version X8.8.2 are vulnerable. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCus99263.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: n/a
product: Cisco Expressway Series Software and Cisco TelePresence VCS Software All versions prior to version X8.8.2 are vulnerable
Published: 2017-02-01T19:00:00.000Z
CVE-2017-3791 
A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. This vulnerability affects Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCvb49837.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: n/a
product: Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1
Published: 2017-02-01T19:00:00.000Z
CVE-2017-3792 
A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability is due to improper size validation when reassembling fragmented IPv4 or IPv6 packets. An attacker could exploit this vulnerability by sending crafted IPv4 or IPv6 fragments to a port receiving content in Passthrough content mode. An exploit could allow the attacker to overflow a buffer. If successful, the attacker could execute arbitrary code or cause a DoS condition on the affected system. Cisco TelePresence MCU platforms TelePresence MCU 5300 Series, TelePresence MCU MSE 8510 and TelePresence MCU 4500 are affected when running software version 4.3(1.68) or later configured for Passthrough content mode. Cisco has released software updates that address this vulnerability. Workarounds that address this vulnerability are not available, but mitigations are available. Cisco Bug IDs: CSCuu67675.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: Cisco TelePresence Multipoint Control Unit (MCU) software version 4.3(1.68) or later configured for Passthrough content mode
Published: 2017-02-01T19:00:00.000Z
CVE-2017-3793 
A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause Cisco ASA and FTD to drop any further incoming traffic on all interfaces, resulting in a denial of service (DoS) condition. The vulnerability is due to improper limitation of the global out-of-order TCP queue for specific block sizes. An attacker could exploit this vulnerability by sending a large number of unique permitted TCP connections with out-of-order segments. An exploit could allow the attacker to exhaust available blocks in the global out-of-order TCP queue, causing the dropping of any further incoming traffic on all interfaces and resulting in a DoS condition. Cisco Bug IDs: CSCvb46321.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: n/a
product: Cisco ASA Software and Cisco FTD Software
Published: 2017-04-20T22:00:00.000Z
CVE-2017-3794 
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an administrative user. More Information: CSCuz03317. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco WebEx Meetings Server 2.6
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3795 
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against any non-administrative user. More Information: CSCuz03345. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.12.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco WebEx Meetings Server 2.6
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3796 
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts. More Information: CSCuz03353. Known Affected Releases: 2.6.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco WebEx Meetings Server 2.6
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3797 
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of the Cisco WebEx administration server. More Information: CSCvb60655. Known Affected Releases: 2.7.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco WebEx Meetings Server 2.7
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3798 
A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to mount XSS attacks against a user of an affected device. More Information: CSCvb97237. Known Affected Releases: 11.0(1.10000.10) 11.5(1.10000.6). Known Fixed Releases: 11.5(1.12029.1) 11.5(1.12900.11) 12.0(0.98000.369) 12.0(0.98000.370) 12.0(0.98000.398) 12.0(0.98000.457).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco Unified Communications Manager
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3799 
A vulnerability in a URL parameter of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to perform site redirection. More Information: CSCzu78401. Known Affected Releases: T28.1.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco WebEx Meeting Center T28.1
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3800 
A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenticated, remote attacker to bypass configured message or content filters on the device. Affected Products: This vulnerability affects all releases prior to the first fixed release of Cisco AsyncOS Software for Cisco Email Security Appliances, both virtual and hardware appliances, if the software is configured to apply a message filter or content filter to incoming email attachments. The vulnerability is not limited to any specific rules or actions for a message filter or content filter. More Information: CSCuz16076. Known Affected Releases: 9.7.1-066 9.7.1-HP2-207 9.8.5-085. Known Fixed Releases: 10.0.1-083 10.0.1-087.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco AsyncOS
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3801 
A vulnerability in the web-based GUI of Cisco UCS Director 6.0.0.0 and 6.0.0.1 could allow an authenticated, local attacker to execute arbitrary workflow items with just an end-user profile, a Privilege Escalation Vulnerability. The vulnerability is due to improper role-based access control (RBAC) after the Developer Menu is enabled in Cisco UCS Director. An attacker could exploit this vulnerability by enabling Developer Mode for his/her user profile with an end-user profile and then adding new catalogs with arbitrary workflow items to his/her profile. An exploit could allow an attacker to perform any actions defined by these workflow items, including actions affecting other tenants. Cisco Bug IDs: CSCvb64765.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: n/a
product: Cisco UCS Director versions 6.0.0.0 and 6.0.0.1
Published: 2017-02-15T20:00:00.000Z
CVE-2017-3802 
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. More Information: CSCvc20679. Known Affected Releases: 12.0(0.99000.9). Known Fixed Releases: 12.0(0.98000.176) 12.0(0.98000.414) 12.0(0.98000.531) 12.0(0.98000.536) 12.0(0.98000.6) 12.0(0.98500.8).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco Unified Communications Manager 12.0(0.99000.9)
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3803 
A vulnerability in the Cisco IOS Software forwarding queue of Cisco 2960X and 3750X switches could allow an unauthenticated, adjacent attacker to cause a memory leak in the software forwarding queue that would eventually lead to a partial denial of service (DoS) condition. More Information: CSCva72252. Known Affected Releases: 15.2(2)E3 15.2(4)E1. Known Fixed Releases: 15.2(2)E6 15.2(4)E3 15.2(5)E1 15.2(5.3.28i)E1 15.2(6.0.49i)E 3.9(1)E.
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco IOS
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3804 
A vulnerability in Intermediate System-to-Intermediate System (IS-IS) protocol packet processing of Cisco Nexus 5000, 6000, and 7000 Series Switches software could allow an unauthenticated, adjacent attacker to cause a reload of the affected device. Switches in the FabricPath domain crash because of an __inst_001__isis_fabricpath hap reset when processing a crafted link-state packet. More Information: CSCvc45002. Known Affected Releases: 7.1(3)N1(2.1) 7.1(3)N1(3.12) 7.3(2)N1(0.296) 8.0(1)S2. Known Fixed Releases: 6.2(18)S11 7.0(3)I5(1.170) 7.0(3)I5(2) 7.1(4)N1(0.4) 7.1(4)N1(1b) 7.1(5)N1(0.986) 7.1(5)N1(1) 7.2(3)D1(0.8) 7.3(2)N1(0.304) 7.3(2)N1(1) 8.0(0.96)S0 8.0(1) 8.0(1)E1 8.0(1)S4 8.3(0)CV(0.788).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco Nexus 5000, 6000, 7000
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3805 
A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to view confidential information that is displayed without authenticating to the device. Affected Products: This vulnerability affects Cisco IOS Software and Cisco IOx Software running on IR829, IR809, IE4K, and CGR1K platforms. More Information: CSCvb20897. Known Affected Releases: 1.0(0).
Problem types: description: unspecified
Affected products: vendor: n/a
product: Cisco IOS and Cisco IOx
Published: 2017-01-26T07:45:00.000Z
CVE-2017-3806 
A vulnerability in CLI command processing in the Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to inject arbitrary shell commands that are executed by the device. More Information: CSCvb61343. Known Affected Releases: 2.0(1.68). Known Fixed Releases: 2.0(1.118) 2.1(1.47) 92.1(1.1646) 92.1(1.1763) 92.2(1.101).
Problem types: description: inject arbitrary shell commands
Affected products: vendor: n/a
product: Cisco Firepower 4100 Series Next-Generation Firewall and Cisco Firepower 9300 Security Appliance 2.0(1.68)
Published: 2017-02-03T07:24:00.000Z
CVE-2017-3807 
A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0-9.6, could allow an authenticated, remote attacker to cause a heap overflow. The vulnerability is due to insufficient validation of user supplied input. An attacker could exploit this vulnerability by sending a crafted URL to the affected system. An exploit could allow the remote attacker to cause a reload of the affected system or potentially execute code. Note: Only traffic directed to the affected system can be used to exploit this vulnerability. This vulnerability affects systems configured in routed firewall mode only and in single or multiple context mode. This vulnerability can be triggered by IPv4 or IPv6 traffic. A valid TCP connection is needed to perform the attack. The attacker needs to have valid credentials to log in to the Clientless SSL VPN portal. Vulnerable Cisco ASA Software running on the following products may be affected by this vulnerability: Cisco ASA 5500 Series Adaptive Security Appliances, Cisco ASA 5500-X Series Next-Generation Firewalls, Cisco Adaptive Security Virtual Appliance (ASAv), Cisco ASA for Firepower 9300 Series, Cisco ASA for Firepower 4100 Series. Cisco Bug IDs: CSCvc23838.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: Cisco ASA Software with Clientless SSL VPN portal is enabled Major Releases 9.0-9.6
Published: 2017-02-09T17:00:00.000Z
CVE-2017-3808 
A vulnerability in the Session Initiation Protocol (SIP) UDP throttling process of Cisco Unified Communications Manager (Cisco Unified CM) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient rate limiting protection. An attacker could exploit this vulnerability by sending the affected device a high rate of SIP messages. An exploit could allow the attacker to cause the device to reload unexpectedly. The device and services will restart automatically. This vulnerability affects Cisco Unified Communications Manager (CallManager) releases prior to the first fixed release; the following list indicates the first minor release that includes the fix for this vulnerability: 10.5.2.14900-16 11.0.1.23900-5 11.5.1.12900-2. Cisco Bug IDs: CSCuz72455.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: Cisco Unified Communications Manager
Published: 2017-04-20T22:00:00.000Z
CVE-2017-3809 
A vulnerability in the Policy deployment module of the Cisco Firepower Management Center (FMC) could allow an unauthenticated, remote attacker to prevent deployment of a complete and accurate rule base. More Information: CSCvb95281. Known Affected Releases: 6.1.0 6.2.0. Known Fixed Releases: 6.1.0.1 6.2.0.
Problem types: description: prevent deployment of a complete and accurate rule base
Affected products: vendor: n/a
product: Cisco Firepower Management Center (FMC) 6.1.0 6.2.0
Published: 2017-02-03T07:24:00.000Z
CVE-2017-3810 
A vulnerability in the web framework of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conduct a web URL redirect attack against a user who is logged in to an affected system. More Information: CSCvb21745. Known Affected Releases: 10.0_R2_tanggula.
Problem types: description: web URL redirect attack
Affected products: vendor: n/a
product: Cisco Prime Service Catalog 10.0_R2_tanggula
Published: 2017-02-03T07:24:00.000Z
CVE-2017-3811 
An XML External Entity vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to have read access to part of the information stored in the affected system. More Information: CSCvc39165. Known Affected Releases: 2.6. Known Fixed Releases: 2.7.1.2054.
Problem types: description: XML External Entity Vulnerability
Affected products: vendor: n/a
product: Cisco WebEx Meetings Server
Published: 2017-03-17T22:00:00.000Z
CVE-2017-3812 
A vulnerability in the implementation of Common Industrial Protocol (CIP) functionality in Cisco Industrial Ethernet 2000 Series Switches could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to a system memory leak. More Information: CSCvc54788. Known Affected Releases: 15.2(5.4.32i)E2. Known Fixed Releases: 15.2(5.4.62i)E2.
Problem types: description: denial of service (DoS)
Affected products: vendor: n/a
product: Cisco Industrial Ethernet 2000 Switches 15.2(5.4.32i)E2
Published: 2017-02-03T07:24:00.000Z
CVE-2017-3813 
A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauthenticated, local attacker to open Internet Explorer with the privileges of the SYSTEM user. The vulnerability is due to insufficient implementation of the access controls. An attacker could exploit this vulnerability by opening the Internet Explorer browser. An exploit could allow the attacker to use Internet Explorer with the privileges of the SYSTEM user. This may allow the attacker to execute privileged commands on the targeted system. This vulnerability affects versions prior to released versions 4.4.00243 and later and 4.3.05017 and later. Cisco Bug IDs: CSCvc43976.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: n/a
product: Cisco AnyConnect Secure Mobility Client Software for Windows Versions prior to released versions 4.4.00243 and later and 4.3.05017 and later.
Published: 2017-02-09T17:00:00.000Z