Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1288 State: PUBLISHED Published: 2018-07-26T14:00:00Z Last Updated: 2024-09-17T02:52:05.951Z Vendors: Apache Software Foundation Products: Apache Kafka Problem Types: Information Disclosure Description: In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef%40%3Cusers.kafka.apache.org%3E - http://www.securityfocus.com/bid
f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef%40%3Cusers.kafka.apache.org%3E - http://www.securityfocus.com/bid/104900 - https://access.redhat.com/errata/RHSA-2018:3768 - https://lists.apache.org/thread.html/d1581fb6464c9bec8a72575c01f5097d68e2fbb230aff24622622a58%40%3Ccommits.kafka.apache.org%3E - https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E - https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists
org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E - https://lists.apache.org/thread.html/r07e1bbd1643847d599feb34c707906a4fdcc81e3a6ab01a10c451d40%40%3Cissues.flink.apache.org%3E - https://www.oracle.com/security-alerts/cpujul2020.html - https://lists.apache.org/thread.html/r35322aec467ddae34002690edaa4d9f16e7df9b5bf7164869b75b62c%40%3Cdev.kafka.apache.org%3E
CVE ID: CVE-2018-1289 State: PUBLISHED Published: 2018-04-20T18:00:00Z Last Updated: 2024-09-17T04:08:48.966Z Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: Information Disclosure Description: In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, the system exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' and 'sortOrder' which are appended directly with SQL statements. A hacker/user can inject/draft the 'orderBy' and 'sortOrder' query parameter in such a way to read/update the data for which he doesn't have authorization. Additional Analyst Notes: - CVE Program Container: Refe
to read/update the data for which he doesn't have authorization. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104005 - https://lists.apache.org/thread.html/4a1312b18ed2979fba9e2df07839e6a940eeeea12ed9154db1a49a5a%40%3Cdev.fineract.apache.org%3E
CVE ID: CVE-2018-1290 State: PUBLISHED Published: 2018-04-20T18:00:00Z Last Updated: 2024-09-16T22:03:02.684Z Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: Information Disclosure Description: In Apache Fineract versions 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, Using a single quotation escape with two continuous SQL parameters can cause a SQL injection. This could be done in Methods like retrieveAuditEntries of AuditsApiResource Class and retrieveCommands of MakercheckersApiResource Class. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/69cc2b54b32f0936f40dc9be41f41fe1566710a75edbe2eb0a948
gram Container: References: - https://lists.apache.org/thread.html/69cc2b54b32f0936f40dc9be41f41fe1566710a75edbe2eb0a948ae4%40%3Cdev.fineract.apache.org%3E - http://www.securityfocus.com/bid/103975
CVE ID: CVE-2018-1291 State: PUBLISHED Published: 2018-04-20T18:00:00Z Last Updated: 2024-09-16T19:20:16.288Z Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: Information Disclosure Description: Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended directly with SQL statements. A hacker/user can inject/draft the 'orderBy' query parameter by way of the "order" param in such a way to read/update the data for which he doesn't have authorization. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apac
which he doesn't have authorization. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/1f7fadc93500b3fe14603b132b13c18fff3d0a35e50ebd0246f325c0%40%3Cdev.fineract.apache.org%3E - http://www.securityfocus.com/bid/104008
CVE ID: CVE-2018-1292 State: PUBLISHED Published: 2018-04-20T18:00:00Z Last Updated: 2024-09-16T19:56:06.458Z Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: Information Disclosure Description: Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization for by way of the 'reportName' parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104007 - https://lists.apache.org/thread.html/a24610817845d022d5fe89cfe21563ef83bea35ca95de867cd2c4ee9%40%3Cdev.fineract.apache.org%3E
CVE ID: CVE-2018-1293 State: REJECTED Published: 2018-11-13T15:00:00 Last Updated: 2018-11-13T14:57:01 Description: No description available.
CVE ID: CVE-2018-1294 State: PUBLISHED Published: 2018-03-20T17:00:00Z Last Updated: 2024-09-16T22:31:23.620Z Vendors: Apache Software Foundation Products: Apache Commons Email Problem Types: Insufficient Data Validation Description: If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String). Addit
rsions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String). Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2018/q1/107
CVE ID: CVE-2018-1295 State: PUBLISHED Published: 2018-04-02T17:00:00Z Last Updated: 2024-09-17T01:06:48.932Z Vendors: Apache Software Foundation Products: Apache Ignite Problem Types: Information Disclosure Description: In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socke
f the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209%40%3Cdev.ignite.apache.org%3E - https://access.redhat.com/errata/RHSA-2018:2405 - http://www.securityfocus.com/bid/103692
CVE ID: CVE-2018-1296 State: PUBLISHED Published: 2019-02-07T22:00:00Z Last Updated: 2024-09-16T19:47:24.798Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: Information Disclosure Description: In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106764 - https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoo
d/106764 - https://lists.apache.org/thread.html/a5b15bc76fbdad2ee40761aacf954a13aeef67e305f86d483f267e8e%40%3Cuser.hadoop.apache.org%3E
CVE ID: CVE-2018-1297 State: PUBLISHED Published: 2018-02-13T12:00:00Z Last Updated: 2024-09-17T03:37:56.459Z Vendors: Apache Software Foundation Products: Apache JMeter Problem Types: Unauthorized code access Description: When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpaNzk5am8oFe07RQ-kynCsQv54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E - https://bz.apache.org/bugzilla/show_bug.cgi?id=62039 - https://lists.apache.
54yB-uYs9bEnz7tbX-O7g%40mail.gmail.com%3E - https://bz.apache.org/bugzilla/show_bug.cgi?id=62039 - https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E
CVE ID: CVE-2018-1298 State: PUBLISHED Published: 2018-02-09T14:00:00Z Last Updated: 2024-09-16T20:59:06.782Z Vendors: Apache Software Foundation Products: Apache Qpid Broker-J Problem Types: Denial of Service Vulnerability Description: A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentic
n authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers". Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be
n Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/d9087e9e57c9b6376754e2b4ea8cd5e9ae6449ed17fc384640c9c9e1%40%3Cusers.qpid.apache.org%3E
CVE ID: CVE-2018-1299 State: PUBLISHED Published: 2018-02-06T19:00:00Z Last Updated: 2024-09-16T21:07:54.673Z Vendors: Apache Software Foundation Products: Apache Allura Problem Types: Information Disclosure Description: In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application. Some webservers used with Allura, such as Nginx, Apache/mod_wsgi or paster may prevent the attack from succeeding. Others, such as gunicorn do not prevent it and leave Allura vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://allura.apache.org/posts/2018-allura-1.8.0.html - https://lists.apache.org/thread.html/b52069073cf
References: - https://allura.apache.org/posts/2018-allura-1.8.0.html - https://lists.apache.org/thread.html/b52069073cf3cb0f84c9e1e2b34d411fc163af39e4f3e50712ac8a4d%40%3Cdev.allura.apache.org%3E
CVE ID: CVE-2018-1300 State: REJECTED Published: 2020-01-06T15:08:53 Last Updated: 2020-01-06T15:08:53 Description: No description available.
CVE ID: CVE-2018-1301 State: PUBLISHED Published: 2018-03-26T15:00:00Z Last Updated: 2024-09-16T17:22:56.161Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Possible out of bound access after failure in reading the HTTP request Description: A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage. Additional Analyst Notes: - CVE Program Container: References: - htt
is classified as low risk for common server usage. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3627-1/ - http://www.securityfocus.com/bid/103515 - http://www.openwall.com/lists/oss-security/2018/03/24/2 - https://www.debian.org/security/2018/dsa-4164 - https://security.netapp.com/advisory/ntap-20180601-0004/ - https://access.redhat.com/errata/RHSA-2018:3558 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - https://usn.ubuntu.com/3627-2/ - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.debian.org/debian-lts-announce/2018/05/
7-2/ - https://httpd.apache.org/security/vulnerabilities_24.html - https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html - https://access.redhat.com/errata/RHSA-2019:0366 - http://www.securitytracker.com/id/1040573 - https://usn.ubuntu.com/3937-2/ - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.
.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876d
0%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76
655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-1302 State: PUBLISHED Published: 2018-03-26T15:00:00Z Last Updated: 2024-09-17T02:41:36.706Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Possible write of after free on HTTP/2 stream shutdown Description: When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk. Additional Analyst Notes: - CVE Program Container: Re
eproduce it outside debug builds, so it is classified as low risk. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20180601-0004/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - http://www.openwall.com/lists/oss-security/2018/03/24/5 - http://www.securityfocus.com/bid/103528 - http://www.securitytracker.com/id/1040567 - https://usn.ubuntu.com/3783-1/ - https://httpd.apache.org/security/vulnerabilities_24.html - https://access.redhat.com/errata/RHSA-2019:0366 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80
://access.redhat.com/errata/RHSA-2019:0366 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.ht
ache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9
bdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-1303 State: PUBLISHED Published: 2018-03-26T15:00:00Z Last Updated: 2024-09-17T02:10:32.813Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Possible out of bound read in mod_cache_socache Description: A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability. Additional Analyst Notes: - CVE Progr
socache is not widely used, mod_cache_disk is not concerned by this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3627-1/ - http://www.securityfocus.com/bid/103522 - https://www.debian.org/security/2018/dsa-4164 - https://security.netapp.com/advisory/ntap-20180601-0004/ - https://access.redhat.com/errata/RHSA-2018:3558 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - https://usn.ubuntu.com/3627-2/ - http://www.securitytracker.com/id/1040572 - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-se
racker.com/id/1040572 - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.openwall.com/lists/oss-security/2018/03/24/3 - https://access.redhat.com/errata/RHSA-2019:0366 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdf
b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.htm
9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-1304 State: PUBLISHED Published: 2018-02-28T20:00:00Z Last Updated: 2024-09-17T01:35:47.135Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Information Disclosure Description: The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possible for unauthorised users to gain access to web application resources that should have been protected. Only security constraints with a URL pattern of the emp
ss to web application resources that should have been protected. Only security constraints with a URL pattern of the empty string were affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:1448 - https://security.netapp.com/advisory/ntap-20180706-0001/ - http://www.securityfocus.com/bid/103170 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - https://access.redhat.com/errata/RHSA-2018:1449 - https://access.redhat.com/errata/RHSA-2018:1450 - https://lists.apache.org/thread.html/b1d7e2425d6fd2cebed40d318f9365b44546077e10949b01b1f8a0fb%40%3Cannounce.tomcat.apache.org%3E - https://www.debian.org/securit