rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-3296 Cisco Small Business RV Series Routers Stack Overflow Arbitrary Code Execution Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, and RV082 Routers could allow an authenticated, remote attacker with administrative privileges to execute arbitrary code on an affected device. The vulnerabilities are due to insufficient boundary restrictions on user-supplied input to scripts in the web-based management interface. An attacker with administrative privileges that are sufficient to log in to the web-based management interface could exploit each vulnerability by sending crafted requests that contain overly large values to an affected device, causing a stack overflow. A successful exploit could allow the attacker to cause the device to crash or allow the attacker to execute arbitrary code with root privileges on the underlying operating system.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: Cisco
product: Cisco Small Business RV Series Router Firmware
Published: 2020-06-18T02:16:22.456Z
CVE-2020-3297 Cisco Small Business Smart and Managed Switches Session Management Vulnerability
A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the privileges of the highjacked session account, which could include administrator privileges on the device. The vulnerability is due to the use of weak entropy generation for session identifier values. An attacker could exploit this vulnerability to determine a current session identifier through brute force and reuse that session identifier to take over an ongoing session. In this way, an attacker could take actions within the management interface with privileges up to the level of the administrative user.
Problem types: cwe_id: CWE-287
description: CWE-287
Affected products: vendor: Cisco
product: Cisco Small Business 200 Series Smart Switches
Published: 2020-07-02T04:20:12.834Z
CVE-2020-3298 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Malformed OSPF Packets Processing Denial of Service Vulnerability
A vulnerability in the Open Shortest Path First (OSPF) implementation of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the reload of an affected device, resulting in a denial of service (DoS) condition. The vulnerability is due to improper memory protection mechanisms while processing certain OSPF packets. An attacker could exploit this vulnerability by sending a series of malformed OSPF packets in a short period of time to an affected device. A successful exploit could allow the attacker to cause a reload of the affected device, resulting in a DoS condition for client traffic that is traversing the device.
Problem types: cwe_id: CWE-125
description: CWE-125
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2020-05-06T16:42:07.687Z
CVE-2020-3299 Multiple Cisco Products SNORT HTTP Detection Engine File Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2020-10-21T18:25:13.223Z
CVE-2020-3301 Cisco Firepower Management Center Static Credential Vulnerabilities
Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensitive part of an affected system with a high-privileged account. For more information about these vulnerabilities, see the Details section of this advisory.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Cisco
product: Cisco Firepower Management Center
Published: 2020-05-06T16:42:12.016Z
CVE-2020-3302 Cisco Firepower Management Center File Overwrite Vulnerability
A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to overwrite files on the file system of an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by uploading a crafted file to the web UI on an affected device. A successful exploit could allow the attacker to overwrite files on the file system of the affected device.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco Firepower Management Center
Published: 2020-05-06T16:42:16.657Z
CVE-2020-3303 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software IKEv1 Denial of Service Vulnerability
A vulnerability in the Internet Key Exchange version 1 (IKEv1) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper management of system memory. An attacker could exploit this vulnerability by sending malicious IKEv1 traffic to an affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.
Problem types: cwe_id: CWE-399
description: CWE-399
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2020-05-06T16:42:21.009Z
CVE-2020-3304 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
A vulnerability in the web interface of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a lack of proper input validation of HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. An exploit could allow the attacker to cause a DoS condition. Note: This vulnerability applies to IP Version 4 (IPv4) and IP Version 6 (IPv6) HTTP traffic.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2020-10-21T18:36:47.782Z
CVE-2020-3305 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software BGP Denial of Service Vulnerability
A vulnerability in the implementation of the Border Gateway Protocol (BGP) module in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to incorrect processing of certain BGP packets. An attacker could exploit this vulnerability by sending a crafted BGP packet. A successful exploit could allow the attacker to cause a DoS condition on the affected device.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2020-05-06T16:42:25.564Z
CVE-2020-3306 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software DHCP Denial of Service Vulnerability
A vulnerability in the DHCP module of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on the affected device. The vulnerability is due to incorrect processing of certain DHCP packets. An attacker could exploit this vulnerability by sending a crafted DHCP packet to the affected device. A successful exploit could allow the attacker to cause a DoS condition on the affected device.
Problem types: cwe_id: CWE-400
description: CWE-400
Affected products: vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
Published: 2020-05-06T16:42:30.062Z
CVE-2020-3307 Cisco Firepower Management Center Arbitrary Log File Write Vulnerability
A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to write arbitrary entries to the log file on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to send incorrect information to the system log on the affected system.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco Firepower Management Center
Published: 2020-05-06T16:42:34.570Z
CVE-2020-3308 Cisco Firepower Threat Defense Software Signature Verification Bypass Vulnerability
A vulnerability in the Image Signature Verification feature of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.
Problem types: cwe_id: CWE-347
description: CWE-347
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2020-05-06T16:50:29.053Z
CVE-2020-3309 Cisco Firepower Device Manager On-Box Software Arbitrary File Overwrite Vulnerability
A vulnerability in Cisco Firepower Device Manager (FDM) On-Box software could allow an authenticated, remote attacker to overwrite arbitrary files on the underlying operating system of an affected device. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by uploading a malicious file to an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on as well as modify the underlying operating system of an affected device.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2020-05-06T16:40:18.441Z
CVE-2020-3310 Cisco Firepower Device Manager On-Box Software XML Parsing Vulnerability
A vulnerability in the XML parser code of Cisco Firepower Device Manager On-Box software could allow an authenticated, remote attacker to cause an affected system to become unstable or reload. The vulnerability is due to insufficient hardening of the XML parser configuration. An attacker could exploit this vulnerability in multiple ways using a malicious file: An attacker with administrative privileges could upload a malicious XML file on the system and cause the XML code to parse the malicious file. An attacker with Clientless Secure Sockets Layer (SSL) VPN access could exploit this vulnerability by sending a crafted XML file. A successful exploit would allow the attacker to crash the XML parser process, which could cause system instability, memory exhaustion, and in some cases lead to a reload of the affected system.
Problem types: cwe_id: CWE-119
description: CWE-119
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2020-05-06T16:40:23.248Z
CVE-2020-3311 Cisco Firepower Management Center Open Redirect Vulnerability
A vulnerability in the web interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a specific malicious web page.
Problem types: cwe_id: CWE-601
description: CWE-601
Affected products: vendor: Cisco
product: Cisco Firepower Management Center
Published: 2020-05-06T16:40:27.986Z
CVE-2020-3312 Cisco Firepower Threat Defense Software Information Disclosure  Vulnerability
A vulnerability in the application policy configuration of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data on an affected device. The vulnerability is due to insufficient application identification. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain unauthorized read access to sensitive data.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2020-05-06T16:40:32.460Z
CVE-2020-3313 Cisco Firepower Management Center Cross-Site Scripting Vulnerability
A vulnerability in the web UI of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or to access sensitive, browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Firepower Management Center
Published: 2020-05-06T16:40:37.390Z
CVE-2020-3314 Cisco AMP for Endpoints Mac Connector Software File Scan Denial of Service Vulnerability
A vulnerability in the file scan process of Cisco AMP for Endpoints Mac Connector Software could cause the scan engine to crash during the scan of local files, resulting in a restart of the AMP Connector and a denial of service (DoS) condition of the Cisco AMP for Endpoints service. The vulnerability is due to insufficient input validation of specific file attributes. An attacker could exploit this vulnerability by providing a crafted file to a user of an affected system. A successful exploit could allow the attacker to cause the Cisco AMP for Endpoints service to crash, resulting in missed detection and logging of the potentially malicious file. Continued attempts to scan the file could result in a DoS condition of the Cisco AMP for Endpoints service.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco AMP for Endpoints
Published: 2020-05-22T05:15:24.949Z
CVE-2020-3315 Multiple Cisco Products Snort HTTP Detection Engine File Policy Bypass Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the configured file policies on an affected system. The vulnerability is due to errors in how the Snort detection engine handles specific HTTP responses. An attacker could exploit this vulnerability by sending crafted HTTP packets that would flow through an affected system. A successful exploit could allow the attacker to bypass the configured file policies and deliver a malicious payload to the protected network.
Problem types: cwe_id: CWE-693
description: CWE-693
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2020-05-06T16:40:42.180Z
CVE-2020-3317 Cisco Firepower Threat Defense Software SSL Input Validation Denial of Service Vulnerability
A vulnerability in the ssl_inspection component of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to crash Snort instances. The vulnerability is due to insufficient input validation in the ssl_inspection component. An attacker could exploit this vulnerability by sending a malformed TLS packet through a Cisco Adaptive Security Appliance (ASA). A successful exploit could allow the attacker to crash a Snort instance, resulting in a denial of service (DoS) condition.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: Cisco
product: Cisco Firepower Threat Defense Software
Published: 2020-10-21T18:36:43.291Z
CVE-2020-3318 Cisco Firepower Management Center Static Credential Vulnerabilities
Multiple vulnerabilities in Cisco Firepower Management Center (FMC) Software and Cisco Firepower User Agent Software could allow an attacker to access a sensitive part of an affected system with a high-privileged account. For more information about these vulnerabilities, see the Details section of this advisory.
Problem types: cwe_id: CWE-798
description: CWE-798
Affected products: vendor: Cisco
product: Cisco Firepower Management Center
Published: 2020-05-06T16:40:46.937Z
CVE-2020-3319 Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability
A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file. This vulnerability affects Cisco Webex Network Recording Player and Webex Player releases earlier than Release 3.0 MR3 Security Patch 2 and 4.0 MR3.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cisco
product: Cisco Webex Network Recording Player
vendor: Cisco
product: Cisco Webex Player for Microsoft Windows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Cisco would like to thank Kexu Wang of Fortinet's FortiGuard Labs for reporting this vulnerability
Published: 2020-06-03T16:55:13.483Z
CVE-2020-3320 Cisco Firepower Management Center Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by first entering input within the web-based management interface and then persuading a user of the interface to view the crafted input within the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Problem types: cwe_id: CWE-79
description: CWE-79
Affected products: vendor: Cisco
product: Cisco Firepower Management Center
Published: 2020-10-08T04:20:12.411Z
CVE-2020-3321 Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability
A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cisco
product: Cisco Webex Network Recording Player
vendor: Cisco
product: Cisco Webex Player for Microsoft Windows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Cisco would like to thank Kexu Wang of Fortinet's FortiGuard Labs for reporting this vulnerability
Published: 2020-06-03T16:55:18.361Z
CVE-2020-3322 Cisco Webex Network Recording Player and Cisco Webex Player Denial of Service Vulnerability
A vulnerability in Cisco Webex Network Recording Player and Cisco Webex Player for Microsoft Windows could allow an attacker to cause a process crash resulting in a Denial of service (DoS) condition for the player application on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to cause the Webex player application to crash when trying to view the malicious file.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Cisco
product: Cisco Webex Network Recording Player
vendor: Cisco
product: Cisco Webex Player for Microsoft Windows
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: Cisco would like to thank Kexu Wang of Fortinet's FortiGuard Labs for reporting this vulnerability
Published: 2020-06-03T17:00:18.648Z