rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-0434 Cisco SD-WAN Solution Certificate Validation Vulnerability
A vulnerability in the Zero Touch Provisioning feature of the Cisco SD-WAN Solution could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.
Problem types: cwe_id: CWE-295
description: CWE-295
Affected products: vendor: Cisco
product: Cisco SD-WAN Solution
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0435 Cisco Umbrella API Unauthorized Access Vulnerability
A vulnerability in the Cisco Umbrella API could allow an authenticated, remote attacker to view and modify data across their organization and other organizations. The vulnerability is due to insufficient authentication configurations for the API interface of Cisco Umbrella. An attacker could exploit this vulnerability to view and potentially modify data for their organization or other organizations. A successful exploit could allow the attacker to read or modify data across multiple organizations.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Cisco
product: Cisco Umbrella
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0436 Cisco Webex Teams Information Disclosure and Modification Vulnerability
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Webex Teams
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0437 Cisco Umbrella Enterprise Roaming Client and Enterprise Roaming Module Privilege Escalation Vulnerability
A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user credentials. This vulnerability is due to improper implementation of file system permissions, which could allow non-administrative users to place files within restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restricted directory, which when executed by the ERC client, would run with Administrator privileges.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: Cisco
product: Cisco Umbrella
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0438 Cisco Umbrella Enterprise Roaming Client Privilege Escalation Vulnerability
A vulnerability in the Cisco Umbrella Enterprise Roaming Client (ERC) could allow an authenticated, local attacker to elevate privileges to Administrator. To exploit the vulnerability, the attacker must authenticate with valid local user credentials. This vulnerability is due to improper implementation of file system permissions, which could allow non-administrative users to place files within restricted directories. An attacker could exploit this vulnerability by placing an executable file within the restricted directory, which when executed by the ERC client, would run with Administrator privileges.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco Umbrella
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0439 Cisco Meeting Server Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Cisco
product: Cisco Meeting Server
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0440 Cisco Data Center Network Manager Privilege Escalation to Underlying Operating System Vulnerability
A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute commands on the underlying operating system with root-level privileges. The vulnerability is due to incomplete input validation of user input within an HTTP request. An attacker could exploit this vulnerability by authenticating to the application and then sending a crafted HTTP request to the targeted application. A successful exploit could allow the authenticated attacker to issue commands on the underlying operating system as the root user.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: Cisco
product: Cisco Data Center Network Manager
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0441 Cisco IOS Access Points Software 802.11r Fast Transition Denial of Service Vulnerability
A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to a corruption of certain timer mechanisms triggered by specific roaming events. This corruption will eventually cause a timer crash. An attacker could exploit this vulnerability by sending malicious reassociation events multiple times to the same AP in a short period of time, causing a DoS condition on the affected AP.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Aironet Access Point Software
Published: 2018-10-17T22:00:00.000Z
CVE-2018-0442 Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Information Disclosure Vulnerability
A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to retrieve memory contents, which could lead to the disclosure of confidential information. The vulnerability is due to insufficient condition checks in the part of the code that handles CAPWAP keepalive requests. An attacker could exploit this vulnerability by sending a crafted CAPWAP keepalive packet to a vulnerable Cisco WLC device. A successful exploit could allow the attacker to retrieve the contents of device memory, which could lead to the disclosure of confidential information.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: Cisco
product: Cisco Wireless LAN Controller (WLC)
Published: 2018-10-17T22:00:00.000Z
CVE-2018-0443 Cisco Wireless LAN Controller Software Control and Provisioning of Wireless Access Points Protocol Denial of Service Vulnerability
A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper input validation on fields within CAPWAP Discovery Request packets by the affected device. An attacker could exploit this vulnerability by sending malicious CAPWAP Discovery Request packets to the Cisco WLC Software. A successful exploit could allow the attacker to cause the Cisco WLC Software to disconnect associated access points (APs). While the APs disconnect and reconnect, service will be unavailable for a brief period of time, resulting in a DoS condition.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Wireless LAN Controller (WLC)
Published: 2018-10-17T22:00:00.000Z
CVE-2018-0444 Cisco Packaged Contact Center Enterprise Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a stored XSS attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Cisco
product: Cisco Packaged Contact Center Enterprise
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0445 Cisco Packaged Contact Center Enterprise Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote attacker to conduct a CSRF attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Cisco
product: Cisco Packaged Contact Center Enterprise
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0446 Cisco Industrial Network Director Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to follow a malicious, customized link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device via a web browser and with the privileges of the user.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Cisco
product: Cisco Industrial Network Director
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0447 Cisco Email Security Appliance URL Filtering Bypass Vulnerability
A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to bypass certain content filters on an affected device. The vulnerability is due to incomplete input and validation checking mechanisms for certain Sender Policy Framework (SPF) messages that are sent to an affected device. An attacker could exploit this vulnerability by sending a customized SPF packet to an affected device. If successful, an exploit could allow the attacker to bypass the URL filters that are configured for the affected device, which could allow malicious URLs to pass through the device.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Email Security Appliance (ESA)
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0448 Cisco Digital Network Architecture Center Authentication Bypass Vulnerability
A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to bypass authentication and take complete control of identity management functions. The vulnerability is due to insufficient security restrictions for critical management functions. An attacker could exploit this vulnerability by sending a valid identity management request to the affected system. An exploit could allow the attacker to view and make unauthorized modifications to existing system users as well as create new users.
Problem types: cwe_id: CWE-326
description: CWE-326
Affected products: vendor: Cisco
product: Cisco Digital Network Architecture Center (DNA Center)
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0449 Cisco Jabber Client Framework Insecure Directory Permissions Vulnerability
A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to corrupt arbitrary files on an affected device that has elevated privileges. The vulnerability exists due to insecure directory permissions set on a JCF created directory. An authenticated attacker with the ability to access an affected directory could create a hard link to an arbitrary location on the affected system. An attacker could convince another user that has administrative privileges to perform an install or update the Cisco Jabber for Mac client to perform such actions, allowing files to be created in an arbitrary location on the disk or an arbitrary file to be corrupted when it is appended to or overwritten.
Problem types: cwe_id: CWE-275
description: CWE-275
Affected products: vendor: Cisco
product: Cisco Jabber for Mac
Published: 2019-01-10T16:00:00.000Z
CVE-2018-0450 Cisco Data Center Network Manager Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the management interface on an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Data Center Network Manager
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0451 Cisco Tetration Analytics Cross-Site Request Forgery Vulnerability
A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an authenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: Cisco
product: Cisco Tetration Analytics
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0452 Cisco Tetration Analytics Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Tetration Analytics
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0453 Cisco Firepower Management Center and Firepower System Software Sourcefire Tunnel Control Channel Command Execution Vulnerability
A vulnerability in the Sourcefire tunnel control channel protocol in Cisco Firepower System Software running on Cisco Firepower Threat Defense (FTD) sensors could allow an authenticated, local attacker to execute specific CLI commands with root privileges on the Cisco Firepower Management Center (FMC), or through Cisco FMC on other Firepower sensors and devices that are controlled by the same Cisco FMC. To send the commands, the attacker must have root privileges for at least one affected sensor or the Cisco FMC. The vulnerability exists because the affected software performs insufficient checks for certain CLI commands, if the commands are executed via a Sourcefire tunnel connection. An attacker could exploit this vulnerability by authenticating with root privileges to a Firepower sensor or Cisco FMC, and then sending specific CLI commands to the Cisco FMC or through the Cisco FMC to another Firepower sensor via the Sourcefire tunnel connection. A successful exploit could allow the attacker to modify device configurations or delete files on the device that is running Cisco FMC Software or on any Firepower device that is managed by Cisco FMC.
Problem types: cwe_id: CWE-264
description: CWE-264
Affected products: vendor: Cisco
product: Cisco FireSIGHT System Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0454 Cisco Cloud Services Platform 2100 Command Injection Vulnerability
A vulnerability in the web-based management interface of Cisco Cloud Services Platform 2100 could allow an authenticated, remote attacker to perform command injection. The vulnerability is due to insufficient input validation of command input. An attacker could exploit this vulnerability by sending customized commands to the web-based management interface.
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: Cisco
product: Cisco Cloud Services Platform 2100
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0455 Cisco Firepower System Software Detection Engine Denial of Service Vulnerability
A vulnerability in the Server Message Block Version 2 (SMBv2) and Version 3 (SMBv3) protocol implementation for the Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause the device to run low on system memory, possibly preventing the device from forwarding traffic. It is also possible that a manual reload of the device may be required to clear the condition. The vulnerability is due to incorrect SMB header validation. An attacker could exploit this vulnerability by sending a custom SMB file transfer through the targeted device. A successful exploit could cause the device to consume an excessive amount of system memory and prevent the SNORT process from forwarding network traffic. This vulnerability can be exploited using either IPv4 or IPv6 in combination with SMBv2 or SMBv3 network traffic.
Problem types: cwe_id: CWE-19
description: CWE-19
Affected products: vendor: Cisco
product: Cisco FireSIGHT System Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0456 Cisco NX-OS Software Authenticated Simple Network Management Protocol Denial of Service Vulnerability
A vulnerability in the Simple Network Management Protocol (SNMP) input packet processor of Cisco NX-OS Software could allow an authenticated, remote attacker to cause the SNMP application of an affected device to restart unexpectedly. The vulnerability is due to improper validation of SNMP protocol data units (PDUs) in SNMP packets. An attacker could exploit this vulnerability by sending a crafted SNMP packet to an affected device. A successful exploit could allow the attacker to cause the SNMP application to restart multiple times, leading to a system-level restart and a denial of service (DoS) condition.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco NX-OS Software for Nexus 3000 Series 7.0(3)I7(3)
Published: 2018-10-17T20:00:00.000Z
CVE-2018-0457 Cisco Webex Player WRF Files Denial of Service Vulnerability
A vulnerability in the Cisco Webex Player for Webex Recording Format (WRF) files could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. An attacker could exploit this vulnerability by sending a user a link or email attachment with a malicious WRF file and persuading the user to open the file in the Cisco Webex Player. A successful exploit could cause the affected player to crash, resulting in a DoS condition. For more information about this vulnerability, see the Details section of this security advisory.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco WebEx WRF Player
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0458 Cisco Prime Collaboration Assurance Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Prime Collaboration Assurance could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Prime Collaboration Assurance
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0459 Cisco Enterprise NFV Infrastructure Software Denial of Service Vulnerability
A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to cause an affected system to reboot or shut down. The vulnerability is due to insufficient server-side authorization checks. An attacker who is logged in to the web-based management interface as a low-privileged user could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to use the low-privileged user account to reboot or shut down the affected system.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: Cisco
product: Cisco Enterprise NFV Infrastructure Software
Published: 2018-10-05T14:00:00.000Z
CVE-2018-0460 Cisco Enterprise NFV Infrastructure Software Information Disclosure Vulnerability
A vulnerability in the REST API of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read any file on an affected system. The vulnerability is due to insufficient authorization and parameter validation checks. An attacker could exploit this vulnerability by sending a malicious API request with the authentication credentials of a low-privileged user. A successful exploit could allow the attacker to read any file on the affected system.
Problem types: cwe_id: CWE-285
description: CWE-285
Affected products: vendor: Cisco
product: Cisco Enterprise NFV Infrastructure Software
Published: 2018-10-05T14:00:00.000Z