rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-15366 
A UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2018-10-23T14:00:00.000Z
CVE-2018-15367 
A ctl_set KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and above could allow a local attacker to escalate privileges on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: Privilege Escalation
Affected products: vendor: Trend Micro
product: Trend Micro Antivirus for Mac (Consumer)
Published: 2018-10-23T14:00:00.000Z
CVE-2018-15368 Cisco IOS XE Software Privileged EXEC Mode Root Shell Access Vulnerability
A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands with root privileges on the device. The vulnerability is due to the affected software improperly sanitizing command arguments to prevent modifications to the underlying Linux filesystem on a device. An attacker who has privileged EXEC mode (privilege level 15) access to an affected device could exploit this vulnerability on the device by executing CLI commands that contain crafted arguments. A successful exploit could allow the attacker to gain access to the underlying Linux shell of the affected device and execute arbitrary commands with root privileges on the device.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco IOS XE Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15369 Cisco IOS and IOS XE Software TACACS+ Client Denial of Service Vulnerability
A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability is due to improper handling of crafted TACACS+ response packets by the affected software. An attacker could exploit this vulnerability by injecting a crafted TACACS+ packet into an existing TACACS+ session between an affected device and a TACACS+ server or by impersonating a known, valid TACACS+ server and sending a crafted TACACS+ packet to an affected device when establishing a connection to the device. To exploit this vulnerability by using either method, the attacker must know the shared TACACS+ secret and the crafted packet must be sent in response to a TACACS+ request from a TACACS+ client. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco IOS Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15370 Cisco Catalyst 6800 Series Switches ROM Monitor Software Secure Boot Bypass Vulnerability
A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local attacker to bypass Cisco Secure Boot validation checks and load a compromised software image on an affected device. The vulnerability is due to the presence of a hidden command in the affected software. An attacker could exploit this vulnerability by connecting to an affected device via the console, forcing the device into ROMMON mode, and writing a malicious pattern to a specific memory address on the device. A successful exploit could allow the attacker to bypass signature validation checks by Cisco Secure Boot technology and load a compromised software image on the affected device. A compromised software image is any software image that has not been digitally signed by Cisco.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: Cisco
product: Cisco Catalyst 6800 Series Switches
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15371 Cisco IOS XE Software Shell Access Authentication Bypass Vulnerability
A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authentication and gain unrestricted access to the root shell of an affected device. The vulnerability exists because the affected software has insufficient authentication mechanisms for certain commands. An attacker could exploit this vulnerability by requesting access to the root shell of an affected device, after the shell access feature has been enabled. A successful exploit could allow the attacker to bypass authentication and gain unrestricted access to the root shell of the affected device.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco IOS XE Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15372 Cisco IOS XE Software MACsec MKA Using EAP-TLS Authentication Bypass Vulnerability
A vulnerability in the MACsec Key Agreement (MKA) using Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) functionality of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to bypass authentication and pass traffic through a Layer 3 interface of an affected device. The vulnerability is due to a logic error in the affected software. An attacker could exploit this vulnerability by connecting to and passing traffic through a Layer 3 interface of an affected device, if the interface is configured for MACsec MKA using EAP-TLS and is running in access-session closed mode. A successful exploit could allow the attacker to bypass 802.1x network access controls and gain access to the network.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco IOS XE Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15373 Cisco IOS and IOS XE Software Cisco Discovery Protocol Denial of Service Vulnerability
A vulnerability in the implementation of Cisco Discovery Protocol functionality in Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust memory on an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper memory handling by the affected software when the software processes high rates of Cisco Discovery Protocol packets that are sent to a device. An attacker could exploit this vulnerability by sending a high rate of Cisco Discovery Protocol packets to an affected device. A successful exploit could allow the attacker to exhaust memory on the affected device, resulting in a DoS condition.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco IOS Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15374 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability
A vulnerability in the Image Verification feature of Cisco IOS XE Software could allow an authenticated, local attacker to install a malicious software image or file on an affected device. The vulnerability is due to the affected software improperly verifying digital signatures for software images and files that are uploaded to a device. An attacker could exploit this vulnerability by uploading a malicious software image or file to an affected device. A successful exploit could allow the attacker to bypass digital signature verification checks for software images and files and install a malicious software image or file on the affected device.
Problem types: cwe_id: CWE-347
description: CWE-347
Affected products: vendor: Cisco
product: Cisco IOS XE Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15375 Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities
A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device.
Problem types: cwe_id: CWE-123
description: CWE-123
Affected products: vendor: Cisco
product: Cisco IOS Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15376 Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers Arbitrary Memory Write Vulnerabilities
A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device.
Problem types: cwe_id: CWE-123
description: CWE-123
Affected products: vendor: Cisco
product: Cisco IOS Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15377 Cisco IOS and IOS XE Software Plug and Play Agent Memory Leak Vulnerability
A vulnerability in the Cisco Network Plug and Play agent, also referred to as the Cisco Open Plug-n-Play agent, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. The vulnerability is due to insufficient input validation by the affected software. An attacker could exploit this vulnerability by sending invalid data to the Cisco Network Plug and Play agent on an affected device. A successful exploit could allow the attacker to cause a memory leak on the affected device, which could cause the device to reload.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco IOS Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15378 Clam AntiVirus unmew11() Denial of Service Vulnerability
A vulnerability in ClamAV versions prior to 0.100.2 could allow an attacker to cause a denial of service (DoS) condition. The vulnerability is due to an error related to the MEW unpacker within the "unmew11()" function (libclamav/mew.c), which can be exploited to trigger an invalid read memory access via a specially crafted EXE file.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: Cisco
product: ClamAV
Published: 2018-10-15T17:00:00.000Z
CVE-2018-15379 Cisco Prime Infrastructure Arbitrary File Upload and Command Execution Vulnerability
A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the privilege level of the user prime. This user does not have administrative or root privileges. The vulnerability is due to an incorrect permission setting for important system directories. An attacker could exploit this vulnerability by uploading a malicious file by using TFTP, which can be accessed via the web-interface GUI. A successful exploit could allow the attacker to run commands on the targeted application without authentication.
Problem types: cwe_id: CWE-275
description: CWE-275
Affected products: vendor: Cisco
product: Cisco Prime Infrastructure
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15380 Cisco HyperFlex Software Command Injection Vulnerability
A vulnerability in the cluster service manager of Cisco HyperFlex Software could allow an unauthenticated, adjacent attacker to execute commands as the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by connecting to the cluster service manager and injecting commands into the bound process. A successful exploit could allow the attacker to run commands on the affected host as the root user. This vulnerability affects Cisco HyperFlex Software releases prior to 3.5(2a).
Problem types: cwe_id: CWE-78
description: CWE-78
Affected products: vendor: Cisco
product: Cisco HyperFlex HX-Series
Published: 2019-02-20T23:00:00.000Z
CVE-2018-15381 Cisco Unity Express Arbitrary Command Execution Vulnerability
A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to the listening Java Remote Method Invocation (RMI) service. A successful exploit could allow the attacker to execute arbitrary commands on the device with root privileges.
Problem types: cwe_id: CWE-502
description: CWE-502
Affected products: vendor: Cisco
product: Cisco Unity Express
Published: 2018-11-08T17:00:00.000Z
CVE-2018-15382 Cisco HyperFlex Software Static Signing Key Vulnerability
A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to generate valid, signed session tokens. The vulnerability is due to a static signing key that is present in all Cisco HyperFlex systems. An attacker could exploit this vulnerability by accessing the static signing key from one HyperFlex system and using it to generate valid, signed session tokens for another HyperFlex system. A successful exploit could allow the attacker to access the HyperFlex Web UI of a system for which they are not authorized.
Problem types: cwe_id: CWE-642
description: CWE-642
Affected products: vendor: Cisco
product: Cisco HyperFlex HX-Series
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15383 Cisco Adaptive Security Appliance Direct Memory Access Denial of Service Vulnerability
A vulnerability in the cryptographic hardware accelerator driver of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a temporary denial of service (DoS) condition. The vulnerability exists because the affected devices have a limited amount of Direct Memory Access (DMA) memory and the affected software improperly handles resources in low-memory conditions. An attacker could exploit this vulnerability by sending a sustained, high rate of malicious traffic to an affected device to exhaust memory on the device. A successful exploit could allow the attacker to exhaust DMA memory on the affected device, which could cause the device to reload and result in a temporary DoS condition.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15386 Cisco Digital Network Architecture Center Unauthenticated Access Vulnerability
A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An attacker could exploit this vulnerability by directly connecting to the exposed services. An exploit could allow the attacker to retrieve and modify critical system files.
Problem types: cwe_id: CWE-16
description: CWE-16
Affected products: vendor: Cisco
product: Cisco Digital Network Architecture Center (DNA Center)
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15387 Cisco SD-WAN Solution Certificate Validation Bypass Vulnerability
A vulnerability in the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to bypass certificate validation on an affected device. The vulnerability is due to improper certificate validation. An attacker could exploit this vulnerability by supplying a system image signed with a crafted certificate to an affected device, bypassing the certificate validation. An exploit could allow an attacker to deploy a crafted system image.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco SD-WAN Solution
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15388 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Denial of Service Vulnerability
A vulnerability in the WebVPN login process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause increased CPU utilization on an affected device. The vulnerability is due to excessive processing load for existing WebVPN login operations. An attacker could exploit this vulnerability by sending multiple WebVPN login requests to the device. A successful exploit could allow the attacker to increase CPU load on the device, resulting in a denial of service (DoS) condition.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2019-05-03T14:30:13.092Z
CVE-2018-15389 Cisco Prime Collaboration Provisioning Intermittent Hard-Coded Password Vulnerability
A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administrative web interface using a default hard-coded username and password that are used during install. The vulnerability is due to a hard-coded password that, in some cases, is not replaced with a unique password. A successful exploit could allow the attacker to access the administrative web interface with administrator-level privileges.
Problem types: cwe_id: CWE-255
description: CWE-255
Affected products: vendor: Cisco
product: Cisco Prime Collaboration Provisioning
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15390 Cisco Firepower Threat Defense Software FTP Inspection Denial of Service Vulnerability
A vulnerability in the FTP inspection engine of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. The vulnerability exists because the affected software fails to release spinlocks when a device is running low on system memory, if the software is configured to apply FTP inspection and an access control rule to transit traffic, and the access control rule is associated with an FTP file policy. An attacker could exploit this vulnerability by sending a high rate of transit traffic through an affected device to cause a low-memory condition on the device. A successful exploit could allow the attacker to cause a software panic on the affected device, which could cause the device to reload and result in a temporary DoS condition.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15391 Cisco Remote PHY IPv4 Fragment Denial of Service Vulnerability
A vulnerability in certain IPv4 fragment-processing functions of Cisco Remote PHY Software could allow an unauthenticated, remote attacker to impact traffic passing through a device, potentially causing a denial of service (DoS) condition. The vulnerability is due to the affected software not validating and calculating certain numerical values in IPv4 packets that are sent to an affected device. An attacker could exploit this vulnerability by sending malformed IPv4 traffic to an affected device. A successful exploit could allow the attacker to disrupt the flow of certain IPv4 traffic passing through an affected device, which could result in a DoS condition.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Remote PHY
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15392 Cisco Industrial Network Director DHCP Request Processing Denial of Service Vulnerability
A vulnerability in the DHCP service of Cisco Industrial Network Director could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper handling of DHCP lease requests. An attacker could exploit this vulnerability by sending malicious DHCP lease requests to an affected application. A successful exploit could allow the attacker to cause the DHCP service to terminate, resulting in a DoS condition.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Industrial Network Director
Published: 2018-10-05T14:00:00.000Z
CVE-2018-15393 Cisco Content Security Management Appliance (SMA) Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Content Security Management Appliance (SMA) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Content Security Management Appliance (SMA)
Published: 2018-11-08T17:00:00.000Z
CVE-2018-15394 Cisco Stealthwatch Management Console Authentication Bypass Vulnerability
A vulnerability in the Stealthwatch Management Console (SMC) of Cisco Stealthwatch Enterprise could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected system. The vulnerability is due to an insecure system configuration. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. An exploit could allow the attacker to gain unauthenticated access, resulting in elevated privileges in the SMC.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Stealthwatch Enterprise
Published: 2018-11-08T17:00:00.000Z
CVE-2018-15395 Cisco Wireless LAN Controller Software Privilege Escalation Vulnerability
A vulnerability in the authentication and authorization checking mechanisms of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, adjacent attacker to gain network access to a Cisco TrustSec domain. Under normal circumstances, this access should be prohibited. The vulnerability is due to the dynamic assignment of Security Group Tags (SGTs) during a wireless roam from one Service Set Identifier (SSID) to another within the Cisco TrustSec domain. An attacker could exploit this vulnerability by attempting to acquire an SGT from other SSIDs within the domain. Successful exploitation could allow the attacker to gain privileged network access that should be prohibited under normal circumstances.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Wireless LAN Controller (WLC)
Published: 2018-10-17T20:00:00.000Z