Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
l Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3460 - http://www.securityfocus.com/bid/105700 - https://access.redhat.com/errata/RHSA-2018:3462 - https://access.redhat.com/errata/RHSA-2018:3505 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16837 - https://access.redhat.com/errata/RHSA-2018:3463 - https://lists.debian.org/debian-lts-announce/2018/11/msg00012.html - https://access.redhat.com/errata/RHSA-2018:3461 - https://www.debian.org/security/2019/dsa-4396 - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html - https://usn.ubuntu.c
019-04/msg00021.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html - https://usn.ubuntu.com/4072-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
CVE ID: CVE-2018-16838 State: PUBLISHED Published: 2019-03-25T17:41:18.000Z Last Updated: 2025-02-13T16:27:17.428Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: sssd Problem Types: CWE-284 Description: A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16838 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00042.html - http
t.com/show_bug.cgi?id=CVE-2018-16838 - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00042.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00051.html - https://access.redhat.com/errata/RHSA-2019:2177 - https://access.redhat.com/errata/RHSA-2019:2437 - https://access.redhat.com/errata/RHSA-2019:3651 - https://lists.debian.org/debian-lts-announce/2023/05/msg00028.html
CVE ID: CVE-2018-16839 State: PUBLISHED Published: 2018-10-31T18:00:00 Last Updated: 2024-08-05T10:32:54.082Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: The Curl Project Products: curl: Problem Types: CWE-190, CWE-122 Description: Curl versions 7.33.0 through 7.61.1 are vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-03 - https://www.debian.org/security/2018/dsa-4331 - https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html - https://curl.haxx.se/docs/CVE-2018-16839.html - https://github.c
.debian.org/debian-lts-announce/2018/11/msg00005.html - https://curl.haxx.se/docs/CVE-2018-16839.html - https://github.com/curl/curl/commit/f3a24d7916b9173c69a3e0ee790102993833d6c5 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16839 - http://www.securitytracker.com/id/1042012 - https://usn.ubuntu.com/3805-1/ - https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E
CVE ID: CVE-2018-16840 State: PUBLISHED Published: 2018-10-31T18:00:00 Last Updated: 2024-08-05T10:32:53.993Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-416 Description: A heap use-after-free flaw was found in curl versions from 7.59.0 through 7.61.1 in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl_close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct. Additional Analyst Notes: - CVE Program Container: References: - htt
to a struct field within that already freed struct. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-03 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16840 - https://github.com/curl/curl/commit/81d135d67155c5295b1033679c606165d4e28f3f - http://www.securitytracker.com/id/1042013 - https://curl.haxx.se/docs/CVE-2018-16840.html - https://usn.ubuntu.com/3805-1/
CVE ID: CVE-2018-16841 State: PUBLISHED Published: 2018-11-28T14:00:00 Last Updated: 2024-08-05T10:32:54.002Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: samba Problem Types: CWE-416 Description: Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-fr
y possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106023 - https://usn.ubuntu.com/3827-2/ - https://usn.ubuntu.com/3827-1/ - https://security.netapp.com/advisory/ntap-20181127-0001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16841 - https://www.debian.org/security/2018/dsa-4345 - https://www.samba.org/samba/security/CVE-2018-16841.html - https://security.gentoo.org/glsa/202003-52
CVE ID: CVE-2018-16842 State: PUBLISHED Published: 2018-10-31T19:00:00 Last Updated: 2024-08-05T10:32:54.082Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) Vendors: The Curl Project Products: curl: Problem Types: CWE-125 Description: Curl versions 7.14.1 through 7.61.1 are vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201903-03 - https://www.debian.org/security/2018/dsa-4331 - https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html - https://curl.haxx.se/docs/CVE
urity/2018/dsa-4331 - https://lists.debian.org/debian-lts-announce/2018/11/msg00005.html - https://curl.haxx.se/docs/CVE-2018-16842.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16842 - http://www.securitytracker.com/id/1042014 - https://github.com/curl/curl/commit/d530e92f59ae9bb2d47066c3c460b25d2ffeb211 - https://usn.ubuntu.com/3805-2/ - https://usn.ubuntu.com/3805-1/ - https://access.redhat.com/errata/RHSA-2019:2181 - https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
CVE ID: CVE-2018-16843 State: PUBLISHED Published: 2018-11-07T14:00:00 Last Updated: 2024-08-05T10:32:54.156Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: nginx Problem Types: CWE-400 Description: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4335 - https://access.redhat.c
st Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4335 - https://access.redhat.com/errata/RHSA-2018:3680 - https://access.redhat.com/errata/RHSA-2018:3681 - http://www.securityfocus.com/bid/105868 - http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html - http://www.securitytracker.com/id/1042038 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16843 - https://access.redhat.com/errata/RHSA-2018:3653 - https://usn.ubuntu.com/3812-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html - https://support.apple.com/kb/HT212818 - http://seclists.org/fulldisclosure/2021/Sep/36
CVE ID: CVE-2018-16844 State: PUBLISHED Published: 2018-11-07T14:00:00 Last Updated: 2024-08-05T10:32:54.086Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: nginx Problem Types: CWE-400 Description: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4335 - https://bugzilla.redhat.com/show
- CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4335 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16844 - https://access.redhat.com/errata/RHSA-2018:3680 - https://access.redhat.com/errata/RHSA-2018:3681 - http://www.securityfocus.com/bid/105868 - http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html - http://www.securitytracker.com/id/1042038 - https://usn.ubuntu.com/3812-1/ - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html - https://support.apple.com/kb/HT212818 - http://seclists.org/fulldisclosure/2021/Sep/36
CVE ID: CVE-2018-16845 State: PUBLISHED Published: 2018-11-07T14:00:00 Last Updated: 2024-08-05T10:32:54.012Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: [UNKNOWN] Products: nginx Problem Types: CWE-400 Description: nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file.
the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4335 - https://access.redhat.com/errata/RHSA-2018:3680 - https://access.redhat.com/errata/RHSA-2018:3681 - http://www.securityfocus.com/bid/105868 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16845 - http://www.securitytracker.com/id/1042039 - https://lists.debian.org/debian-lts-announce/2018/11/msg00010.html - https:
http://www.securitytracker.com/id/1042039 - https://lists.debian.org/debian-lts-announce/2018/11/msg00010.html - https://access.redhat.com/errata/RHSA-2018:3653 - https://access.redhat.com/errata/RHSA-2018:3652 - https://usn.ubuntu.com/3812-1/ - http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html - https://support.apple.com/kb/HT212818 - http://seclists.org/fulldisclosure/2021/Sep/36
CVE ID: CVE-2018-16846 State: PUBLISHED Published: 2019-01-15T18:00:00 Last Updated: 2024-08-05T10:32:53.997Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: ceph Problem Types: CWE-770 Description: It was found in Ceph versions before 13.2.4 that authenticated ceph RGW users can cause a denial of service against OMAPs holding bucket indices. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2019/03/msg00002.html - http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html - https://usn.ubuntu.com/4035-1/ - https://access.redhat.com/errata/RHSA-2019:2538 - https:/
ounce/2019-04/msg00100.html - https://usn.ubuntu.com/4035-1/ - https://access.redhat.com/errata/RHSA-2019:2538 - https://access.redhat.com/errata/RHSA-2019:2541 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16846 - https://ceph.com/releases/13-2-4-mimic-released/ - https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html
CVE ID: CVE-2018-16847 State: PUBLISHED Published: 2018-11-02T22:00:00 Last Updated: 2024-08-05T10:32:54.125Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: [UNKNOWN] Products: QEMU: Problem Types: CWE-787 Description: An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16847 - https://www.openwa
: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16847 - https://www.openwall.com/lists/oss-security/2018/11/02/1 - https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg00200.html - https://usn.ubuntu.com/3826-1/ - http://www.securityfocus.com/bid/105866
CVE ID: CVE-2018-16848 State: PUBLISHED Published: 2020-06-15T14:18:22 Last Updated: 2024-08-05T10:32:54.030Z Vendors: n/a Products: openstack-mistral Problem Types: Denial of Service Description: A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1645332 - https://bugs.launchpad.net/mistral/+bug/1785657
CVE ID: CVE-2018-16849 State: PUBLISHED Published: 2018-11-02T21:00:00 Last Updated: 2024-08-05T10:32:54.175Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: openstack-mistral Problem Types: CWE-200 Description: A flaw was found in openstack-mistral. By manipulating the SSH private key filename, the std.ssh action can be used to disclose the presence of arbitrary files within the filesystem of the executor running the action. Since std.ssh private_key_filename can take an absolute path, it can be used to assess whether or not a file exists on the executor's filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://
ot a file exists on the executor's filesystem. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/mistral/+bug/1783708 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16849
CVE ID: CVE-2018-16850 State: PUBLISHED Published: 2018-11-13T15:00:00 Last Updated: 2024-08-05T10:32:54.106Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: The PostgreSQL Project Products: postgresql Problem Types: CWE-89 Description: postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3818-1/ - https://access.redhat.com/errata/RHSA-2018:3757 - https://www.postgresql.
References: - https://usn.ubuntu.com/3818-1/ - https://access.redhat.com/errata/RHSA-2018:3757 - https://www.postgresql.org/about/news/1905/ - http://www.securitytracker.com/id/1042144 - https://security.gentoo.org/glsa/201811-24 - http://www.securityfocus.com/bid/105923 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16850
CVE ID: CVE-2018-16851 State: PUBLISHED Published: 2018-11-28T14:00:00 Last Updated: 2024-08-05T10:32:53.988Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: samba Problem Types: CWE-476 Description: Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability a
ss providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106027 - https://usn.ubuntu.com/3827-2/ - https://usn.ubuntu.com/3827-1/ - https://security.netapp.com/advisory/ntap-20181127-0001/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00005.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16851 - https://www.debian.org/security/2018/dsa-4345 - https://www.samba.org/samba/security/CVE-2018-16851.html - https://security.gentoo.org/glsa/202003-52
CVE ID: CVE-2018-16852 State: PUBLISHED Published: 2018-11-28T14:00:00 Last Updated: 2024-08-05T10:32:54.124Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: samba Problem Types: CWE-476 Description: Samba from version 4.9.0 and before version 4.9.3 is vulnerable to a NULL pointer de-reference. During the processing of an DNS zone in the DNS management DCE/RPC server, the internal DNS server or the Samba DLZ plugin for BIND9, if the DSPROPERTY_ZONE_MASTER_SERVERS property or DSPROPERTY_ZONE_SCAVENGING_SERVERS property is set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue,
set, the server will follow a NULL pointer and terminate. There is no further vulnerability associated with this issue, merely a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2018-16852.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16852 - https://security.netapp.com/advisory/ntap-20181127-0001/ - http://www.securityfocus.com/bid/106024 - https://security.gentoo.org/glsa/202003-52
CVE ID: CVE-2018-16853 State: PUBLISHED Published: 2018-11-28T14:00:00 Last Updated: 2024-08-05T10:32:54.157Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: samba Problem Types: CWE-400 Description: Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases
curity patches for this configuration. Additionally, Samba 4.7.12, 4.8.7 and 4.9.3 have been issued as security releases to prevent building of the AD DC with MIT Kerberos unless --with-experimental-mit-ad-dc is specified to the configure command. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16853 - https://www.samba.org/samba/security/CVE-2018-16853.html - http://www.securityfocus.com/bid/106026 - https://security.netapp.com/advisory/ntap-20181127-0001/ - https://security.gentoo.org/glsa/202003-52
CVE ID: CVE-2018-16854 State: PUBLISHED Published: 2018-11-26T17:00:00 Last Updated: 2024-08-05T10:32:54.258Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-352 Description: A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16854 - http://www.securitytracker.com/id/1042154 - http://git.moodle.org/
/bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16854 - http://www.securitytracker.com/id/1042154 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-63183 - http://www.securityfocus.com/bid/106017 - https://moodle.org/mod/forum/discuss.php?d=378731
CVE ID: CVE-2018-16855 State: PUBLISHED Published: 2018-12-03T14:00:00 Last Updated: 2024-08-05T10:32:54.074Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: pdns-recursor Problem Types: CWE-125 Description: An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16855 - https://docs.powerdns.com/recursor/security-advisories/powerdns-advis
gzilla.redhat.com/show_bug.cgi?id=CVE-2018-16855 - https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-09.html
CVE ID: CVE-2018-16856 State: PUBLISHED Published: 2019-03-26T17:45:29 Last Updated: 2024-08-05T10:32:54.143Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: openstack-octavia Problem Types: CWE-532 Description: In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id
n exposure. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16856
CVE ID: CVE-2018-16857 State: PUBLISHED Published: 2018-11-28T14:00:00 Last Updated: 2024-08-05T10:32:54.067Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: [UNKNOWN] Products: samba Problem Types: CWE-358 Description: Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords (to restrict brute forcing of passwords) in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been upgraded from Samba 4.8 and earlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not
arlier. In these cases the manual testing done to confirm an organisation's password policies apply as expected may not have been re-done after the upgrade. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20181127-0001/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16857 - http://www.securityfocus.com/bid/106024 - https://www.samba.org/samba/security/CVE-2018-16857.html - https://security.gentoo.org/glsa/202003-52
CVE ID: CVE-2018-16858 State: PUBLISHED Published: 2019-03-25T17:43:08 Last Updated: 2024-08-05T10:32:54.146Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: libreoffice Problem Types: CWE-356 Description: It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location. Additional Analyst Notes: - CVE Program Container: