rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-0377 
A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote attacker to directly connect to the OSGi interface. The vulnerability is due to a lack of authentication. An attacker could exploit this vulnerability by directly connecting to the OSGi interface. An exploit could allow the attacker to access or change any files that are accessible by the OSGi process. Cisco Bug IDs: CSCvh18017.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: n/a
product: Cisco Policy Suite unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0378 Cisco NX-OS Software for Nexus 5500, 5600, and 6000 Series Switches Precision Time Protocol Denial of Service Vulnerability
A vulnerability in the Precision Time Protocol (PTP) feature of Cisco Nexus 5500, 5600, and 6000 Series Switches running Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a lack of protection against PTP frame flood attacks. An attacker could exploit this vulnerability by sending large streams of malicious IPv4 or IPv6 PTP traffic to the affected device. A successful exploit could allow the attacker to cause a DoS condition, impacting the traffic passing through the device.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco NX-OS Software for Nexus 6000 Series
Published: 2018-10-17T21:00:00.000Z
CVE-2018-0379 
Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to launch the file in the Webex recording players. Exploitation of these vulnerabilities could allow arbitrary code execution on the system of a targeted user. These vulnerabilities affect ARF and WRF recording players available from Cisco Webex Meetings Suite sites, Cisco Webex Meetings Online sites, and Cisco Webex Meetings Server. Cisco Bug IDs: CSCvi02621, CSCvi02965, CSCvi63329, CSCvi63333, CSCvi63335, CSCvi63374, CSCvi63376, CSCvi63377, CSCvi63391, CSCvi63392, CSCvi63396, CSCvi63495, CSCvi63497, CSCvi63498, CSCvi82684, CSCvi82700, CSCvi82705, CSCvi82725, CSCvi82737, CSCvi82742, CSCvi82760, CSCvi82771, CSCvj51284, CSCvj51294.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: n/a
product: Cisco Webex Network Recording Players unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0380 
Multiple vulnerabilities exist in the Cisco Webex Network Recording Player for Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit these vulnerabilities by providing a user with a malicious .arf or .wrf file via email or URL and convincing the user to launch the file in the Webex recording players. Exploitation of these vulnerabilities could cause an affected player to crash, resulting in a denial of service (DoS) condition. The Cisco Webex players are applications that are used to play back Webex meetings that have been recorded by an online meeting attendee. The Webex Network Recording Player for .arf files can be automatically installed when the user accesses a recording that is hosted on a Webex server. The Webex Player for .wrf files can be downloaded manually. These vulnerabilities affect ARF and WRF recording players available from Cisco Webex Meetings Suite sites, Cisco Webex Meetings Online sites, and Cisco Webex Meetings Server. Cisco Bug IDs: CSCvh70253, CSCvh70268, CSCvh72272, CSCvh72281, CSCvh72285, CSCvi60477, CSCvi60485, CSCvi60490, CSCvi60520, CSCvi60529, CSCvi60533.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: n/a
product: Cisco Webex Network Recording Players unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0381 Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability
A vulnerability in the Cisco Aironet Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a deadlock condition that may occur when an affected AP attempts to dequeue aggregated traffic that is destined to an attacker-controlled wireless client. An attacker who can successfully transition between multiple Service Set Identifiers (SSIDs) hosted on the same AP while replicating the required traffic patterns could trigger the deadlock condition. A watchdog timer that detects the condition will trigger a reload of the device, resulting in a DoS condition while the device restarts.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Aironet Access Points
Published: 2018-10-17T22:00:00.000Z
CVE-2018-0382 Cisco Wireless LAN Controller Software Session Hijacking Vulnerability
A vulnerability in the session identification management functionality of the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to hijack a valid user session on an affected system. The vulnerability exists because the affected software does not properly clear previously assigned session identifiers for a user session when a user authenticates to the web-based interface. An attacker could exploit this vulnerability by using an existing session identifier to connect to the software through the web-based interface. Successful exploitation could allow the attacker to hijack an authenticated user's browser session on the system. Versions 8.1 and 8.5 are affected.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Cisco
product: Cisco Wireless LAN Controller (WLC)
Published: 2019-04-17T21:35:14.963Z
CVE-2018-0383 
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a file policy that is configured to block the transfer of files to an affected system via FTP. The vulnerability exists because the affected software incorrectly handles FTP control connections. An attacker could exploit this vulnerability by sending a maliciously crafted FTP connection to transfer a file to an affected device. A successful exploit could allow the attacker to bypass a file policy that is configured to apply the Block upload with reset action to FTP traffic. Cisco Bug IDs: CSCvh70130.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: n/a
product: Cisco FireSIGHT unknown
Published: 2018-07-16T17:00:00.000Z
CVE-2018-0384 
A vulnerability in the detection engine of Cisco FireSIGHT System Software could allow an unauthenticated, remote attacker to bypass a URL-based access control policy that is configured to block traffic for an affected system. The vulnerability exists because the affected software incorrectly handles TCP packets that are received out of order when a TCP SYN retransmission is issued. An attacker could exploit this vulnerability by sending a maliciously crafted connection through an affected device. A successful exploit could allow the attacker to bypass a URL-based access control policy that is configured to block traffic for the affected system. Cisco Bug IDs: CSCvh84511.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: n/a
product: Cisco FireSIGHT unknown
Published: 2018-07-16T17:00:00.000Z
CVE-2018-0385 
A vulnerability in the detection engine parsing of Security Socket Layer (SSL) protocol packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition due to the Snort process unexpectedly restarting. The vulnerability is due to improper input handling of the SSL traffic. An attacker could exploit this vulnerability by sending a crafted SSL traffic to the detection engine on the targeted device. An exploit could allow the attacker to cause a DoS condition if the Snort process restarts and traffic inspection is bypassed or traffic is dropped. Cisco Bug IDs: CSCvi36434.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: n/a
product: Cisco Firepower unknown
Published: 2018-07-16T17:00:00.000Z
CVE-2018-0386 
A vulnerability in Cisco Unified Communications Domain Manager Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on an affected system. The vulnerability is due to improper validation of input that is passed to the affected software. An attacker could exploit this vulnerability by persuading a user of the affected software to access a malicious URL. A successful exploit could allow the attacker to access sensitive, browser-based information on the affected system or perform arbitrary actions in the affected software in the security context of the user. Cisco Bug IDs: CSCvh49694.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco Systems, Inc.
product: Unified Communications Domain Manager Software
Published: 2018-08-15T20:00:00.000Z
CVE-2018-0387 
A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on the user's device, possibly with elevated privileges. The vulnerability occurs because Cisco Webex Teams does not properly sanitize input. An attacker could exploit the vulnerability by sending a user a malicious link and persuading the user to follow the link. A successful exploit could allow the attacker to execute arbitrary code on the user's system. Cisco Bug IDs: CSCvh66250.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: Cisco Webex Teams unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0388 Cisco Wireless LAN Controller Software Cross-Site Scripting Vulnerability
A vulnerability in the web-based interface of Cisco Wireless LAN Controller (WLC) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web-based interface of an affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Wireless LAN Controller (WLC)
Published: 2018-10-17T19:00:00.000Z
CVE-2018-0389 Cisco Small Business SPA514G IP Phones SIP Denial of Service Vulnerability
A vulnerability in the implementation of Session Initiation Protocol (SIP) processing in Cisco Small Business SPA514G IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The vulnerability is due to improper processing of SIP request messages by an affected device. An attacker could exploit this vulnerability by sending crafted SIP messages to an affected device. A successful exploit could allow the attacker to cause the affected device to become unresponsive, resulting in a DoS condition that persists until the device is restarted manually. Cisco has not released software updates that address this vulnerability. This vulnerability affects Cisco Small Business SPA514G IP Phones that are running firmware release 7.6.2SR2 or earlier.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Small Business SPA500 Series IP Phones
Published: 2019-03-13T21:00:00.000Z
CVE-2018-0390 
A vulnerability in the web framework of Cisco Webex could allow an unauthenticated, remote attacker to conduct a Document Object Model-based (DOM-based) cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software by using the HTTP POST method. An attacker who can submit malicious scripts to the affected user interface element could execute arbitrary script or HTML code in the user's browser in the context of the affected site. Cisco Bug IDs: CSCvj33287.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cisco Webex unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0391 
A vulnerability in the password change function of Cisco Prime Collaboration Provisioning could allow an authenticated, remote attacker to cause the system to become inoperable. The vulnerability is due to insufficient validation of a password change request. An attacker could exploit this vulnerability by changing a specific administrator account password. A successful exploit could allow the attacker to cause the affected device to become inoperable, resulting in a denial of service (DoS) condition. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.2 and prior. Cisco Bug IDs: CSCvd86586.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Cisco Prime Collaboration Provisioning unknown
Published: 2018-08-01T20:00:00.000Z
CVE-2018-0392 
A vulnerability in the CLI of Cisco Policy Suite could allow an authenticated, local attacker to access files owned by another user. The vulnerability is due to insufficient access control permissions (i.e., World-Readable). An attacker could exploit this vulnerability by logging in to the CLI. An exploit could allow the attacker to access potentially sensitive files that are owned by a different user. Cisco Bug IDs: CSCvh18087.
Problem types: cwe_id: CWE-275
description: CWE-275
Affected products: vendor: n/a
product: Cisco Policy Suite unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0393 
A Read-Only User Effect Change vulnerability in the Policy Builder interface of Cisco Policy Suite could allow an authenticated, remote attacker to make policy changes in the Policy Builder interface. The vulnerability is due to insufficient authorization controls. An attacker could exploit this vulnerability by accessing the Policy Builder interface and modifying an HTTP request. A successful exploit could allow the attacker to make changes to existing policies. Cisco Bug IDs: CSCvi35007.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: n/a
product: Cisco Policy Suite unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0394 
A vulnerability in the web upload function of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to obtain restricted shell access on an affected system. The vulnerability is due to insufficient input validation of parameters passed to a specific function within the user interface. An attacker could exploit this vulnerability by injecting code into a function parameter. Cisco Bug IDs: CSCvi12935.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: Cisco Cloud Services Platform 2100 unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0395 Cisco FXOS and NX-OS Software Link Layer Discovery Protocol Denial of Service Vulnerability
A vulnerability in the Link Layer Discovery Protocol (LLDP) implementation for Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition when the device unexpectedly reloads. The vulnerability is due to improper input validation of certain type, length, value (TLV) fields of the LLDP frame header. An attacker could exploit this vulnerability by sending a crafted LLDP packet to an interface on the targeted device. A successful exploit could allow the attacker to cause the switch to reload unexpectedly.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco NX-OS Software
vendor: Cisco
product: Firepower 4100 Series Next-Generation Firewalls
Published: 2018-10-17T20:00:00.000Z
CVE-2018-0396 
A vulnerability in the web framework of the Cisco Unified Communications Manager IM and Presence Service software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting certain malicious code. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve25985.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cisco Unified Communications Manager IM And Presence Service unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0397 
A vulnerability in Cisco AMP for Endpoints Mac Connector Software installed on Apple macOS 10.12 could allow an unauthenticated, remote attacker to cause a kernel panic on an affected system, resulting in a denial of service (DoS) condition. The vulnerability exists if the affected software is running in Block network conviction mode. Exploitation could occur if the system that is running the affected software starts a server process and an address in the IP blacklist cache of the affected software attempts to connect to the affected system. A successful exploit could allow the attacker to cause a kernel panic on the system that is running the affected software, resulting in a DoS condition. Cisco Bug IDs: CSCvk08192.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: n/a
product: Cisco AMP for Endpoints Mac Connector unknown
Published: 2018-08-01T20:00:00.000Z
CVE-2018-0398 
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a server-side request forgery (SSRF) attack. Cisco Bug IDs: CSCvg71018.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: n/a
product: Cisco Finesse unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0399 
Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to retrieve a cleartext password from an affected system. Cisco Bug IDs: CSCvg71044.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: n/a
product: Cisco Finesse unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0400 
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. Cisco Bug IDs: CSCvg70904.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cisco Unified Contact Center Express unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0401 
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. Cisco Bug IDs: CSCvg70967.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cisco Unified Contact Center Express unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0402 
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. Cisco Bug IDs: CSCvg70921.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cisco Unified Contact Center Express unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0403 
Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to retrieve a cleartext password. Cisco Bug IDs: CSCvg71040.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cisco Unified Contact Center Express unknown
Published: 2018-07-18T23:00:00.000Z
CVE-2018-0404 Cisco RV180W Wireless-N Multifunction VPN Router SQL Injection Vulnerability
A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The attacker could retrieve sensitive information which should be restricted. The product has entered the end-of-life phase and there will be no more firmware fixes.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: Cisco
product: Cisco RV180W Wireless-N Multifunction VPN Router
Published: 2018-10-05T16:00:00.000Z
CVE-2018-0405 Cisco RV180W Wireless-N Multifunction VPN Router Directory Path Traversal Vulnerability
A vulnerability in the web framework code for Cisco RV180W Wireless-N Multifunction VPN Router and Small Business RV Series RV220W Wireless Network Security Firewall could allow an unauthenticated, remote attacker to conduct a directory path traversal attack on a targeted device. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location.
Problem types: cwe_id: CWE-22
description: CWE-22
Affected products: vendor: Cisco
product: Cisco RV180W Wireless-N Multifunction VPN Router
Published: 2018-10-05T17:00:00.000Z
CVE-2018-0406 
A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to conduct a reflected or Document Object Model based (DOM-based) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve84006.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: n/a
product: Cisco Web Security Appliance unknown
Published: 2018-08-01T20:00:00.000Z