Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-1270 State: PUBLISHED Published: 2018-04-06T13:00:00Z Last Updated: 2024-09-16T19:05:05.139Z Vendors: Spring by Pivotal Products: Spring Framework Problem Types: CWE-94 Description: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2939 - https://www.exploit-db.com
tes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2939 - https://www.exploit-db.com/exploits/44796/ - http://www.securityfocus.com/bid/103696 - https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%
//lists.apache.org/thread.html/6d3d34adcf3dfc48e36342aa1f18ce3c20bb8e4c458a97508d5bfed1%40%3Cissues.activemq.apache.org%3E - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://pivotal.io/security/cve-2018-1270 - https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://lists.debian.org/debian
bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E - https://lists.debian.org/debian-lts-announce/2021/04/msg00022.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-1271 State: PUBLISHED Published: 2018-04-06T13:00:00Z Last Updated: 2024-09-16T23:16:43.841Z Vendors: Spring by Pivotal Products: Spring Framework Problem Types: CWE-22 Description: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. Additional Analyst Notes: - CVE Program Container: References: - http:
d URL that can lead a directory traversal attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103699 - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:2939 - https://access.redhat.com/errata/RHSA-2018:1320 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://pivotal.io/sec
019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://pivotal.io/security/cve-2018-1271 - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-1272 State: PUBLISHED Published: 2018-04-06T13:00:00Z Last Updated: 2024-09-17T02:15:49.301Z Vendors: Spring by Pivotal Products: Spring Framework Problem Types: CAPEC-233 - Privilege Escalation Description: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server
e exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103697 - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:1320 - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html -
le.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://pivotal.io/security/cve-2018-1272 - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-1273 State: PUBLISHED Published: 2018-04-11T13:00:00.000Z Last Updated: 2025-10-21T23:45:52.285Z Vendors: Spring by Pivotal Products: Spring Framework Problem Types: CWE-94 Description: Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack. Additional Analyst Notes: - CVE Progra
ion-based request payload binding hat can lead to a remote code execution attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://mail-archives.apache.org/mod_mbox/ignite-dev/201807.mbox/%3CCAK0qHnqzfzmCDFFi6c5Jok19zNkVCz5Xb4sU%3D0f2J_1i4p46zQ%40mail.gmail.com%3E - https://www.oracle.com/security-alerts/cpujul2022.html - https://pivotal.io/security/cve-2018-1273
CVE ID: CVE-2018-1274 State: PUBLISHED Published: 2018-04-18T16:00:00Z Last Updated: 2024-09-17T01:11:48.375Z Vendors: Spring by Pivotal Products: Spring Framework Problem Types: Denial of Service Description: Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/b
and memory consumption). Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103769 - https://www.oracle.com/security-alerts/cpujul2022.html - https://pivotal.io/security/cve-2018-1274
CVE ID: CVE-2018-1275 State: PUBLISHED Published: 2018-04-11T13:00:00Z Last Updated: 2024-09-17T02:43:01.710Z Vendors: Spring by Pivotal Products: Spring Framework Problem Types: CWE-94 Description: Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework. Additional Analyst Notes: - CVE Program Con
e partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041301 - https://access.redhat.com/errata/RHSA-2018:2939 - https://access.redhat.com/errata/RHSA-2018:1320 - http://www.securityfocus.com/bid/103771 - https://lists.apache.org/thread.html/4ed49b103f64a0cecb38064f26cbf1389afc12124653da2d35166dbe%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/ab825fcade0b49becfa30235b3d54f4a51bb74ea96b6c9adb5d1378c%40%3Cissues.activemq.apache.org%3E - https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.acti
.org%3E - https://lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E - http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html - https://pivotal.io/security/cve-2018-1275 - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2018-1276 State: PUBLISHED Published: 2018-05-17T20:00:00Z Last Updated: 2024-09-16T23:16:44.783Z Vendors: Cloud Foundry Products: Windows2012R2 stemcell Problem Types: Information exposure Description: Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can execute crafted commands to read the IaaS metadata from the VM, which may contain BOSH credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1276/
CVE ID: CVE-2018-1277 State: PUBLISHED Published: 2018-04-30T20:00:00Z Last Updated: 2024-09-17T00:16:40.209Z Vendors: Cloud Foundry Products: Garden-runC Problem Types: Denial of Service Description: Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an app with a malicious Docker image that will consume more space on a Diego cell than allocated in their quota, potentially causing a DoS against the cell. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2018-1277/
CVE ID: CVE-2018-1278 State: PUBLISHED Published: 2018-05-11T20:00:00Z Last Updated: 2024-09-16T23:42:24.325Z Vendors: Pivotal Products: Pivotal Application Service Problem Types: Authorization Error Description: Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 contains an authorization enforcement vulnerability. A member of any org is able to create invitations to any org for which the org GUID can be discovered. Accepting this invitation gives unauthorized access to view the member list, domains, quotas and other information about the org. Additional Analyst Notes: - CVE Program Container: References: -
, domains, quotas and other information about the org. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-1278 - http://www.securityfocus.com/bid/104227
CVE ID: CVE-2018-1279 State: PUBLISHED Published: 2018-12-10T19:00:00Z Last Updated: 2024-09-17T00:37:15.917Z Severity: HIGH (CVSS 8.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Pivotal Products: RabbitMq for PCF Problem Types: Use of Insufficiently Random Values Description: Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster. Additional Analy
ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-1279
CVE ID: CVE-2018-1280 State: PUBLISHED Published: 2018-05-11T20:00:00Z Last Updated: 2024-09-16T19:51:38.651Z Vendors: Pivotal Products: Greenplum Command Center Problem Types: SQL Injection Description: Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability. An unauthenticated user can perform a SQL injection in the command center which results in disclosure of database contents. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2018-1280 - http://www.securityfocus.com/bid/104153
CVE ID: CVE-2018-1281 State: PUBLISHED Published: 2018-06-08T19:00:00Z Last Updated: 2024-09-17T00:26:46.445Z Vendors: Apache Software Foundation Products: Apache MXNet Problem Types: Allows unauthorized access Description: The clustered setup of Apache MXNet allows users to specify which IP address and port the scheduler will listen on via the DMLC_PS_ROOT_URI and DMLC_PS_ROOT_PORT env variables. In versions older than 1.0.0, however, the MXNet framework will listen on 0.0.0.0 rather than user specified DMLC_PS_ROOT_URI once a scheduler node is initialized. This exposes the instance running MXNet to any attackers reachable via the interface they didn't expect to be listening on. For example
e instance running MXNet to any attackers reachable via the interface they didn't expect to be listening on. For example: If a user wants to run a clustered setup locally, they may specify to run on 127.0.0.1. But since MXNet will listen on 0.0.0.0, it makes the port accessible on all network interfaces. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dmlc/ps-lite/commit/4be817e8b03e7e92517e91f2dfcc50865e91c6ea
CVE ID: CVE-2018-1282 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T23:51:40.485Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: SQL Injection Description: This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103751 - https://lists.apache.org/thread.html/74bd2bff1827febb348dfb323986fa340d3bb97a315ab93c3ccc8299%40%3Cdev.hive.apache.org%3E
CVE ID: CVE-2018-1283 State: PUBLISHED Published: 2018-03-26T15:00:00Z Last Updated: 2024-09-16T19:36:29.564Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: Tampering of mod_session data for CGI applications. Description: In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. Additional Ana
prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3627-1/ - https://www.debian.org/security/2018/dsa-4164 - https://security.netapp.com/advisory/ntap-20180601-0004/ - https://access.redhat.com/errata/RHSA-2018:3558 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://access.redhat.com/errata/RHSA-2019:0367 - http://www.securitytracker.com/id/1040568 - https://usn.ubuntu.com/3627-2/ - http://www.securityfocus.com/bid/103520 - http://www.openwall.com/lists/oss-security/2018/03/24/4 - https://httpd.a
2/ - http://www.securityfocus.com/bid/103520 - http://www.openwall.com/lists/oss-security/2018/03/24/4 - https://httpd.apache.org/security/vulnerabilities_24.html - https://access.redhat.com/errata/RHSA-2019:0366 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d31
04975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://list
he.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfc
%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-1284 State: PUBLISHED Published: 2018-04-05T13:00:00Z Last Updated: 2024-09-16T18:38:28.397Z Vendors: Apache Software Foundation Products: Apache Hive Problem Types: XML Injection Description: In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if hive.server2.enable.doAs=false. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/29184dbce4a37be2af36e539ecb479b1d27868f73ccfdff46c7174b4%40%3Cdev.hi
References: - https://lists.apache.org/thread.html/29184dbce4a37be2af36e539ecb479b1d27868f73ccfdff46c7174b4%40%3Cdev.hive.apache.org%3E - http://www.securityfocus.com/bid/103750
CVE ID: CVE-2018-1285 State: PUBLISHED Published: 2020-05-11T16:41:28 Last Updated: 2024-08-05T03:59:37.654Z Vendors: n/a Products: Apache log4net Problem Types: XXE Description: Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files. Additional Analyst Notes: - CVE Program Container: References: - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2U233HVAQDSZ2PRG4XSGDASLY3J6ALH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messag
SZ2PRG4XSGDASLY3J6ALH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKL2LPINAI6BCMXOH4V4HVHGLUXIWOFO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT2DNNSW7C7FNK3MA3SLEUHGW5USYZKE/ - https://lists.apache.org/thread.html/r33564de316d4e4ba0fea1d4d079e62cde1ffe64369c1157243d840d9%40%3Cdev.logging.apache.org%3E - https://lists.apache.org/thread.html/r9de86a185575e6c5f92e2a70a1d2e2e9514dc4341251577aac8e3866%40%3Cdev.logging.apache.org%3E - https://lists.apache.org/thread.html/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f%40%3Cdev.logging.apache.org%3E - https://lists.apache.org/
tml/r6543acafca3e2d24ff4b0c364a91540cb9378977ffa8d37a03ab4b0f%40%3Cdev.logging.apache.org%3E - https://lists.apache.org/thread.html/r7ab6b6e702f11a6f77b0db2af2d5e5532f56ae4b99b5fe73c5200b6a%40%3Cdev.logging.apache.org%3E - https://lists.apache.org/thread.html/rdbac24c945ca5c69cd5348b5ac023bc625768f653335de146e09ae2d%40%3Cdev.logging.apache.org%3E - https://lists.apache.org/thread.html/rd2d72a017e238d1f345f9d14e075c81be16fc68a41c9e9ad9e29a732%40%3Cdev.logging.apache.org%3E - https://lists.apache.org/thread.html/r00b16ac5e0bbf7009a0d167ed58f3f94d0033b0f4b3e3d5025cc4872%40%3Cdev.logging.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html
ev.logging.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2021.html - https://lists.apache.org/thread.html/reab1c277c95310bad1038255e0757857b2fbe291411b4fa84552028a%40%3Cdev.logging.apache.org%3E - https://issues.apache.org/jira/browse/LOG4NET-575 - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.apache.org/thread.html/r525cbbd7db0aef4a114cf60de8439aa285decc34904d42a7f14f39c3%40%3Cdev.logging.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20220909-0001/
CVE ID: CVE-2018-1286 State: PUBLISHED Published: 2018-02-28T18:00:00Z Last Updated: 2024-09-16T18:07:50.245Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: Insufficient Access Controls Description: In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/dc2151baa5301bae773603cede0d62c21ee28588dd06e5e9253c13a8%40%3Cuser.openmeetings.apache.org%3E
CVE ID: CVE-2018-1287 State: PUBLISHED Published: 2018-02-14T14:00:00Z Last Updated: 2024-09-17T03:02:25.926Z Vendors: Apache Software Foundation Products: Apache JMeter Problem Types: Unauthorized code execution Description: In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103068 - http://mail-archives.apache.org/mod_mbox/www-announce/201802.mbox/%3CCAH9fUpYsFx1%2Brwz1A%3Dmc7wAgbDHARyj1VrWNg41y9OySuL1mqw%40mail.gmail.com%3E - https:
od_mbox/www-announce/201802.mbox/%3CCAH9fUpYsFx1%2Brwz1A%3Dmc7wAgbDHARyj1VrWNg41y9OySuL1mqw%40mail.gmail.com%3E - https://lists.apache.org/thread.html/31e0adbeca9d865ff74d0906b2248a41a1457cb54c1afbe5947df58b%40%3Cissues.jmeter.apache.org%3E