Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-8619 State: PUBLISHED Published: 2018-08-01T06:00:00 Last Updated: 2024-08-06T02:27:40.965Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-416 Description: The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free. Additional Analyst Notes: - CVE Program Container: References: - https://curl.haxx.se/docs/adv_20161102E.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8619 - https://curl.haxx.se/CVE-2016-8619.patch - http://www.securityfocus.com/bid/94100 - https://www.tenable.com/sec
6-8619 - https://curl.haxx.se/CVE-2016-8619.patch - http://www.securityfocus.com/bid/94100 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47
CVE ID: CVE-2016-8620 State: PUBLISHED Published: 2018-08-01T06:00:00 Last Updated: 2024-08-06T02:27:40.910Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-120 Description: The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read via user controlled input. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94102 - https://access.redhat.com/errata/RHSA-2018:3558 - https://curl.haxx.se/docs/adv_20161102F.html - https://www.tenable.com/security/tns-2016-21 - https://bugzilla.redhat.com/show_bug.cgi?id=CV
/docs/adv_20161102F.html - https://www.tenable.com/security/tns-2016-21 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8620 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://security.gentoo.org/glsa/201701-47
CVE ID: CVE-2016-8621 State: PUBLISHED Published: 2018-07-31T22:00:00 Last Updated: 2024-08-06T02:27:41.134Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-125 Description: The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an input with one digit short. Additional Analyst Notes: - CVE Program Container: References: - https://curl.haxx.se/docs/adv_20161102G.html - https://access.redhat.com/errata/RHSA-2018:3558 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8621 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.co
.redhat.com/show_bug.cgi?id=CVE-2016-8621 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://curl.haxx.se/CVE-2016-8621.patch - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - http://www.securityfocus.com/bid/94101
CVE ID: CVE-2016-8622 State: PUBLISHED Published: 2018-07-31T21:00:00 Last Updated: 2024-08-06T02:27:40.993Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-190, CWE-122 Description: The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if this function would be made to allocate a unscape destination buffer larger than 2GB, it would return that new length in a signed 32 bit integer variable, thus the length would get either just truncated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer. A
cated or both truncated and turned negative. That could then lead to libcurl writing outside of its heap based buffer. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3558 - https://curl.haxx.se/docs/adv_20161102H.html - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - http://www.securityfocus.com/bid/94105 - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8622
CVE ID: CVE-2016-8623 State: PUBLISHED Published: 2018-08-01T06:00:00 Last Updated: 2024-08-06T02:27:41.010Z Severity: LOW (CVSS 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-416 Description: A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-after-free leading to information disclosure. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8623 - https://access.redhat.com/errata/RHSA-2018:3558 - https://curl.haxx.se/docs/adv_20161102I.html - http://www.securityfocus.com/bid/94106 - https://www.tenable
-2018:3558 - https://curl.haxx.se/docs/adv_20161102I.html - http://www.securityfocus.com/bid/94106 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://curl.haxx.se/CVE-2016-8623.patch - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2016-8624 State: PUBLISHED Published: 2018-07-31T21:00:00 Last Updated: 2024-08-06T02:27:41.205Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-20 Description: curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with a '#' character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. Additional Analyst Notes: - CVE Program Container: References: - https://access.r
ins before using curl to request them. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3558 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8624 - https://www.tenable.com/security/tns-2016-21 - http://www.securitytracker.com/id/1037192 - http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html - https://curl.haxx.se/docs/adv_20161102J.html - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - http://www.securityfocus.com/bid/94103 - https://lists.apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E - htt
apache.org/thread.html/rfaa4d578587f52a9c4d176af516a681a712c664e3be440a4163691d5%40%3Ccommits.pulsar.apache.org%3E - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2016-8625 State: PUBLISHED Published: 2018-08-01T06:00:00 Last Updated: 2024-08-06T02:27:41.183Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Curl Project Products: curl Problem Types: CWE-20 Description: curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead users to potentially and unknowingly issue network transfer requests to the wrong host. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94107 - https://curl.haxx.se/CVE-2016-8625.patch - https://access.redhat.com/errata/RHSA-2018:3558 - https://www.tenable.com/security/tns-201
haxx.se/CVE-2016-8625.patch - https://access.redhat.com/errata/RHSA-2018:3558 - https://www.tenable.com/security/tns-2016-21 - https://curl.haxx.se/docs/adv_20161102K.html - http://www.securitytracker.com/id/1037192 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8625 - https://access.redhat.com/errata/RHSA-2018:2486 - https://security.gentoo.org/glsa/201701-47 - https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E - https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
CVE ID: CVE-2016-8626 State: PUBLISHED Published: 2018-07-31T19:00:00 Last Updated: 2024-08-06T02:27:41.046Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Ceph Problem Types: CWE-476 Description: A flaw was found in Red Hat Ceph before 0.94.9-8. The way Ceph Object Gateway handles POST object requests permits an authenticated attacker to launch a denial of service attack by sending null or specially crafted POST object requests. Additional Analyst Notes: - CVE Program Container: References: - http://tracker.ceph.com/issues/17635 - http://rhn.redhat.com/errata/RHSA-2016-2815.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8626
es/17635 - http://rhn.redhat.com/errata/RHSA-2016-2815.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8626 - http://www.securityfocus.com/bid/94488 - http://rhn.redhat.com/errata/RHSA-2016-2816.html - http://rhn.redhat.com/errata/RHSA-2016-2847.html - http://rhn.redhat.com/errata/RHSA-2016-2848.html
CVE ID: CVE-2016-8627 State: PUBLISHED Published: 2018-05-11T13:00:00 Last Updated: 2024-08-06T02:27:41.200Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: admin-cli Problem Types: CWE-400 Description: admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com
er functioning could be impaired. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0250.html - http://rhn.redhat.com/errata/RHSA-2017-0171.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8627 - https://access.redhat.com/errata/RHSA-2017:3458 - http://rhn.redhat.com/errata/RHSA-2017-0244.html - http://rhn.redhat.com/errata/RHSA-2017-0172.html - http://www.securitytracker.com/id/1037660 - http://rhn.redhat.com/errata/RHSA-2017-0246.html - http://www.securityfocus.com/bid/95698 - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2017:3454 - h
a/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2017:3454 - http://rhn.redhat.com/errata/RHSA-2017-0170.html - http://rhn.redhat.com/errata/RHSA-2017-0245.html - http://rhn.redhat.com/errata/RHSA-2017-0247.html - http://rhn.redhat.com/errata/RHSA-2017-0173.html
CVE ID: CVE-2016-8628 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-06T02:27:40.971Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: Ansible Problem Types: CWE-77 Description: Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:2778 - http://www.securityfocus.com/bid/94109 - https://bugzilla.redhat.com/show_
s://access.redhat.com/errata/RHSA-2016:2778 - http://www.securityfocus.com/bid/94109 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628
CVE ID: CVE-2016-8629 State: PUBLISHED Published: 2018-03-12T15:00:00Z Last Updated: 2024-09-16T17:52:54.232Z Vendors: Red Hat, Inc. Products: Keycloak Problem Types: CWE-284 Description: Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0876.html - http://www.securitytracker.com/id/1038180 - https://bugzilla.redhat.com/show_bug.cgi?id=1388988 - http://www.
876.html - http://www.securitytracker.com/id/1038180 - https://bugzilla.redhat.com/show_bug.cgi?id=1388988 - http://www.securityfocus.com/bid/97392 - https://access.redhat.com/errata/RHSA-2017:0873 - https://access.redhat.com/errata/RHSA-2017:0872
CVE ID: CVE-2016-8630 State: PUBLISHED Published: 2016-11-28T03:01:00 Last Updated: 2024-08-06T02:27:41.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: The x86_decode_insn function in arch/x86/kvm/emulate.c in the Linux kernel before 4.8.7, when KVM is enabled, allows local users to cause a denial of service (host OS crash) via a certain use of a ModR/M byte in an undefined instruction. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.7 - http://www.securityfocus.com/bid/94459 - https://bugzilla.redhat.com/show_bug.cgi?id=1393350 - http://rhn.redhat.com/errata/RHSA-2017-0387.html - https://github.com/to
//bugzilla.redhat.com/show_bug.cgi?id=1393350 - http://rhn.redhat.com/errata/RHSA-2017-0387.html - https://github.com/torvalds/linux/commit/d9092f52d7e61dd1557f2db2400ddb430e85937e - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d9092f52d7e61dd1557f2db2400ddb430e85937e - http://www.openwall.com/lists/oss-security/2016/11/22/3 - http://rhn.redhat.com/errata/RHSA-2017-0386.html
CVE ID: CVE-2016-8631 State: PUBLISHED Published: 2018-07-31T20:00:00 Last Updated: 2024-08-06T02:27:41.243Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Openshift Enterprise Problem Types: CWE-20 Description: The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94110 - https://access.redhat.com/errata/RHSA-2016:2696 - https://bugzilla.redhat.com/show
p://www.securityfocus.com/bid/94110 - https://access.redhat.com/errata/RHSA-2016:2696 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8631
CVE ID: CVE-2016-8632 State: PUBLISHED Published: 2016-11-28T03:01:00 Last Updated: 2024-08-06T02:27:41.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/11/08/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1390832 - http://www.securityfocus.com
com/lists/oss-security/2016/11/08/5 - https://bugzilla.redhat.com/show_bug.cgi?id=1390832 - http://www.securityfocus.com/bid/94211 - https://www.mail-archive.com/netdev%40vger.kernel.org/msg133205.html
CVE ID: CVE-2016-8633 State: PUBLISHED Published: 2016-11-28T03:01:00 Last Updated: 2024-08-06T02:27:41.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.7 - http://www.securityfocus.com/bid/94149 - https://access.redhat.com/errata/RHSA-2018:1062 - https://eyalitkin.wordpress.com/2016/11/06/cve-publication-cve-2016-8633/ - https://access.redhat.com/errata/RHSA-2018:0676 - https
litkin.wordpress.com/2016/11/06/cve-publication-cve-2016-8633/ - https://access.redhat.com/errata/RHSA-2018:0676 - https://bugzilla.redhat.com/show_bug.cgi?id=1391490 - https://github.com/torvalds/linux/commit/667121ace9dbafb368618dbabcf07901c962ddac - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9dbafb368618dbabcf07901c962ddac - http://www.openwall.com/lists/oss-security/2016/11/06/1 - https://access.redhat.com/errata/RHSA-2019:1170 - https://access.redhat.com/errata/RHSA-2019:1190
CVE ID: CVE-2016-8634 State: PUBLISHED Published: 2018-08-01T12:00:00 Last Updated: 2024-08-06T02:27:41.211Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: The Foreman Project Products: foreman Problem Types: CWE-79 Description: A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman, if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created, then a user is linked directly to this URL. Additional Analyst Notes: - CVE Program Contain
HTML in the name is created, then a user is linked directly to this URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94206 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8634 - https://projects.theforeman.org/issues/17195
CVE ID: CVE-2016-8635 State: PUBLISHED Published: 2018-08-01T13:00:00 Last Updated: 2024-08-06T02:27:41.258Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Mozilla Products: nss Problem Types: CWE-358 Description: It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8635 - http://rhn.redhat.com/errata/RHSA-2016-2779.html - https://security.ge
gzilla.redhat.com/show_bug.cgi?id=CVE-2016-8635 - http://rhn.redhat.com/errata/RHSA-2016-2779.html - https://security.gentoo.org/glsa/201701-46 - http://www.securityfocus.com/bid/94346
CVE ID: CVE-2016-8636 State: PUBLISHED Published: 2017-02-22T16:00:00 Last Updated: 2024-08-06T02:27:41.119Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the "RDMA protocol over infiniband" (aka Soft RoCE) technology. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/96189 - http://www.openwall.com/lists/oss-security/
VE Program Container: References: - http://www.securityfocus.com/bid/96189 - http://www.openwall.com/lists/oss-security/2017/02/11/9 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.10 - https://eyalitkin.wordpress.com/2017/02/11/cve-publication-cve-2016-8636/ - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=647bf3d8a8e5777319da92af672289b2a6c4dc66 - https://bugzilla.redhat.com/show_bug.cgi?id=1421981 - https://github.com/torvalds/linux/commit/647bf3d8a8e5777319da92af672289b2a6c4dc66
CVE ID: CVE-2016-8637 State: PUBLISHED Published: 2018-08-01T13:00:00 Last Updated: 2024-08-06T02:27:41.222Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: The Dracut Project Products: dracut Problem Types: CWE-732 Description: A local information disclosure issue was found in dracut before 045 when generating initramfs images with world-readable permissions when 'early cpio' is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8
Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8637 - https://github.com/dracutdevs/dracut/commit/0db98910a11c12a454eac4c8e86dc7a7bbc764a4 - http://www.securityfocus.com/bid/94128 - http://seclists.org/oss-sec/2016/q4/352
CVE ID: CVE-2016-8638 State: PUBLISHED Published: 2017-07-12T13:00:00 Last Updated: 2024-08-06T02:27:41.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://ipsilon-project.org/release/2.1.0.html - https://bugzilla.redhat.com/show_bug.cgi?
gram Container: References: - https://ipsilon-project.org/release/2.1.0.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638 - https://pagure.io/ipsilon/c/511fa8b7001c2f9a42301aa1d4b85aaf170a461c - https://ipsilon-project.org/advisory/CVE-2016-8638.txt - http://www.securityfocus.com/bid/94439 - http://rhn.redhat.com/errata/RHSA-2016-2809.html
CVE ID: CVE-2016-8639 State: PUBLISHED Published: 2018-08-01T13:00:00 Last Updated: 2024-08-06T02:27:41.125Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: The Foreman Project Products: foreman Problem Types: CWE-79 Description: It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker with privileges to set the organization or location name to display arbitrary HTML including scripting code within the web interface. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8639 - https://access.redhat.com/errata/RHSA-20
iner: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8639 - https://access.redhat.com/errata/RHSA-2018:0336 - https://github.com/theforeman/foreman/pull/3523 - http://www.securityfocus.com/bid/94263 - https://projects.theforeman.org/issues/15037
CVE ID: CVE-2016-8640 State: PUBLISHED Published: 2018-08-01T18:00:00Z Last Updated: 2024-09-17T00:31:15.280Z Vendors: https://github.com/geopython Products: pycsw Problem Types: CWE-89 Description: A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94302 - https://github.com/geopython/pycsw/pull/4