Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-1000218 State: PUBLISHED Published: 2017-06-16T21:00:00 Last Updated: 2024-08-06T03:55:27.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kibana Reporting plugin version 2.4.0 is vulnerable to a CSRF vulnerability that could allow an attacker to generate superfluous reports whenever an authenticated Kibana user navigates to a specially-crafted page. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99253 - https://www.elastic.co/community/security
CVE ID: CVE-2016-1000219 State: PUBLISHED Published: 2017-06-16T21:00:00 Last Updated: 2024-08-06T03:55:27.714Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kibana before 4.5.4 and 4.1.11 when a custom output is configured for logging in, cookies and authorization headers could be written to the log files. This information could be used to hijack sessions of other users when using Kibana behind some form of authentication such as Shield. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99178 - https://www.elastic.co/community/security
CVE ID: CVE-2016-1000220 State: PUBLISHED Published: 2017-06-16T21:00:00 Last Updated: 2024-08-06T03:55:27.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kibana before 4.5.4 and 4.1.11 are vulnerable to an XSS attack that would allow an attacker to execute arbitrary JavaScript in users' browsers. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99179 - https://www.elastic.co/community/security
CVE ID: CVE-2016-1000221 State: PUBLISHED Published: 2017-06-16T21:00:00 Last Updated: 2024-08-06T03:55:27.403Z Vendors: n/a Products: n/a Problem Types: n/a Description: Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99126 - https://www.elastic.co/community/security
CVE ID: CVE-2016-1000222 State: PUBLISHED Published: 2017-06-16T21:00:00 Last Updated: 2024-08-06T03:55:27.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Logstash prior to version 2.1.2, the CSV output can be attacked via engineered input that will create malicious formulas in the CSV data. Additional Analyst Notes: - CVE Program Container: References: - https://www.elastic.co/community/security
CVE ID: CVE-2016-1000229 State: PUBLISHED Published: 2019-12-20T13:02:44 Last Updated: 2024-08-06T03:55:27.059Z Vendors: n/a Products: n/a Problem Types: n/a Description: swagger-ui has XSS in key names Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229 - http://www.securityfocus.com/bid/97580 - https://access.redhat.com/errata/RHSA-2017:0868
CVE ID: CVE-2016-1000232 State: PUBLISHED Published: 2018-09-05T17:00:00 Last Updated: 2024-08-06T03:55:27.288Z Vendors: n/a Products: n/a Problem Types: n/a Description: NodeJS Tough-Cookie version 2.2.2 contains a Regular Expression Parsing vulnerability in HTTP request Cookie Header parsing that can result in Denial of Service. This attack appear to be exploitable via Custom HTTP header passed by client. This vulnerability appears to have been fixed in 2.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2016:2101 - https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulne
- https://www.ibm.com/blogs/psirt/ibm-security-bulletin-ibm-api-connect-is-affected-by-node-js-tough-cookie-module-vulnerability-to-a-denial-of-service-cve-2016-1000232/ - https://access.redhat.com/errata/RHSA-2017:2912 - https://www.npmjs.com/advisories/130 - https://github.com/salesforce/tough-cookie/commit/615627206357d997d5e6ff9da158997de05235ae - https://access.redhat.com/security/cve/cve-2016-1000232 - https://github.com/salesforce/tough-cookie/commit/e4fc2e0f9ee1b7a818d68f0ac7ea696f377b1534
CVE ID: CVE-2016-1000236 State: PUBLISHED Published: 2019-11-19T17:01:15 Last Updated: 2024-08-06T03:55:27.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2016-1000236 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000236 - https://bugzilla.redhat.com/show_bug.cgi?id=1371409 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838618 - https://www.mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.html - https://travis-ci.com/nodejs/sec
ps://www.mail-archive.com/secure-testing-team%40lists.alioth.debian.org/msg06583.html - https://travis-ci.com/nodejs/security-wg/builds/76423102
CVE ID: CVE-2016-1000237 State: PUBLISHED Published: 2020-01-23T14:21:28 Last Updated: 2024-08-06T03:55:27.115Z Vendors: n/a Products: n/a Problem Types: n/a Description: sanitize-html before 1.4.3 has XSS. Additional Analyst Notes: - CVE Program Container: References: - https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json - https://nodesecurity.io/advisories/135
CVE ID: CVE-2016-1000258 State: REJECTED Published: 2017-04-14T14:00:00Z Last Updated: 2024-09-16T20:32:39.998Z Description: No description available.
CVE ID: CVE-2016-1000259 State: REJECTED Published: 2017-04-14T14:00:00Z Last Updated: 2024-09-16T22:20:33.775Z Description: No description available.
CVE ID: CVE-2016-1000268 State: REJECTED Published: 2017-04-03T05:44:00Z Last Updated: 2024-09-16T17:33:18.977Z Description: No description available.
CVE ID: CVE-2016-1000271 State: PUBLISHED Published: 2019-02-04T21:00:00Z Last Updated: 2024-09-17T01:30:32.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: Joomla extension DT Register version before 3.1.12 (Joomla 3.x) / 2.8.18 (Joomla 2.5) contains an SQL injection in "/index.php?controller=calendar&format=raw&cat[0]=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/140141/Joomla-DT-Register-SQL-Injection.html
CVE ID: CVE-2016-1000276 State: REJECTED Published: 2019-02-04T22:00:00 Last Updated: 2019-02-25T18:57:01 Description: No description available.
CVE ID: CVE-2016-1000282 State: PUBLISHED Published: 2019-02-05T17:00:00 Last Updated: 2024-08-06T03:55:27.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py
CVE ID: CVE-2016-1000306 State: REJECTED Published: 2017-04-06T23:00:00Z Last Updated: 2024-09-16T19:04:40.784Z Description: No description available.
CVE ID: CVE-2016-1000307 State: PUBLISHED Published: 2017-04-06T23:00:00Z Last Updated: 2024-09-17T01:05:52.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) Vulnerabilities in ClipBucket v2.8.1 and probably prior allow Remote Attackers to inject arbitrary web script or HTML via (1) profile_desc, about_me, schools, occupation, companies, hobbies, fav_movies, fav_music, fav_books parameters to ProfileSettings page; (2) note parameter to PersonalNotes Section; (3) closed_msg, description, allowed_types parameters to WebsiteConfigurations Section. NOTE: the collection_description vector is already covered by CVE-2015-4673. Additional Analyst Not
figurations Section. NOTE: the collection_description vector is already covered by CVE-2015-4673. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/distributedweaknessfiling/DWF-Database-Artifacts/blob/master/DWF/2016/1000307/CVE-2016-1000307.json
CVE ID: CVE-2016-1000338 State: PUBLISHED Published: 2018-06-01T00:00:00 Last Updated: 2024-08-06T03:55:27.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.u
s.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://access.redhat.com/errata/RHSA-2018:2927 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/bcgit/bc-java/commit/b0c3ce99d43d73a096268831d0d120ffc89eac7f#diff-3679f5a9d2b939d0d3ee1601a7774fb0 - https://security.netapp.com/advisory/ntap-20231006-0011/
CVE ID: CVE-2016-1000339 State: PUBLISHED Published: 2018-06-04T13:00:00 Last Updated: 2024-08-06T03:55:27.243Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES cl
ine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://github.com/bcgit/bc-java/commit/8a73f08931450c17c749af067b6a8185abdfd2c0#diff-494fb066bed02aeb76b6c005632943f2 - https://securit
om/bcgit/bc-java/commit/8a73f08931450c17c749af067b6a8185abdfd2c0#diff-494fb066bed02aeb76b6c005632943f2 - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/413b42f4d770456508585c830cfcde95f9b0e93b#diff-54656f860db94b867ba7542430cd2ef0
CVE ID: CVE-2016-1000340 State: PUBLISHED Published: 2018-06-04T13:00:00 Last Updated: 2024-08-06T03:55:27.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our
urve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/790642084c4e0cadd47352054f868cc8397e2c00#diff-e5934feac8203ca0104ab291a3560a31
CVE ID: CVE-2016-1000341 State: PUBLISHED Published: 2018-06-04T13:00:00 Last Updated: 2024-08-06T03:55:27.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - h
https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/acaac81f96fec91ab45bd0412beaf9c3acd8defa#diff-e75226a9ca49217a7276b29242ec59ce
CVE ID: CVE-2016-1000342 State: PUBLISHED Published: 2018-06-04T13:00:00 Last Updated: 2024-08-06T03:55:27.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn
sts.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/843c2e60f67d71faf81d236f448ebbe56c62c647#diff-25c3c78db788365f36839b3f2d3016b9
CVE ID: CVE-2016-1000343 State: PUBLISHED Published: 2018-06-04T13:00:00 Last Updated: 2024-08-06T03:55:27.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.h
al Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://access.redhat.com/errata/RHSA-2018:2927 - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/50a53068c094d6cff37659da33c9b4505becd389#diff-5578e61500abb2b87b300d3114bdfd7d
CVE ID: CVE-2016-1000344 State: PUBLISHED Published: 2018-06-04T21:00:00 Last Updated: 2024-08-06T03:55:27.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/9385b0eb
t2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/9385b0ebd277724b167fe1d1456e3c112112be1f
CVE ID: CVE-2016-1000345 State: PUBLISHED Published: 2018-06-04T21:00:00 Last Updated: 2024-08-06T03:55:27.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://acces
2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/21dcb3d9744c83dcf2ff8fcee06dbca7bfa4ef35#diff-4439ce586bf9a13bfec05c0d113b8098
CVE ID: CVE-2016-1000346 State: PUBLISHED Published: 2018-06-04T21:00:00 Last Updated: 2024-08-06T03:55:27.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.u
s.debian.org/debian-lts-announce/2018/07/msg00009.html - https://access.redhat.com/errata/RHSA-2018:2669 - https://usn.ubuntu.com/3727-1/ - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/1127131c89021612c6eefa26dbe5714c194e7495#diff-d525a20b8acaed791ae2f0f770eb5937
CVE ID: CVE-2016-1000348 State: REJECTED Published: 2017-04-03T01:00:00Z Last Updated: 2024-09-17T01:25:46.130Z Description: No description available.
CVE ID: CVE-2016-1000349 State: REJECTED Published: 2017-04-03T05:44:00Z Last Updated: 2024-09-17T01:51:48.882Z Description: No description available.
CVE ID: CVE-2016-1000350 State: REJECTED Published: 2017-04-03T01:00:00Z Last Updated: 2024-09-16T22:51:55.528Z Description: No description available.
CVE ID: CVE-2016-1000351 State: REJECTED Published: 2017-04-03T05:44:00Z Last Updated: 2024-09-17T00:11:35.555Z Description: No description available.
CVE ID: CVE-2016-1000352 State: PUBLISHED Published: 2018-06-04T21:00:00 Last Updated: 2024-08-06T03:55:27.595Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2669 - https://access.redhat.com/errata/RHSA-2018:2927 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20181127-0004/ - https://github.com/bcgit/bc-java/commit/9385b0eb
CVE ID: CVE-2016-1000360 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T20:13:23.403Z Description: No description available.
CVE ID: CVE-2016-1000361 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-17T00:36:08.098Z Description: No description available.
CVE ID: CVE-2016-1000362 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T17:39:19.370Z Description: No description available.
CVE ID: CVE-2016-1000363 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T22:45:52.896Z Description: No description available.
CVE ID: CVE-2016-1000364 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T21:57:58.881Z Description: No description available.
CVE ID: CVE-2016-1000365 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T19:30:11.960Z Description: No description available.
CVE ID: CVE-2016-1000366 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T22:21:04.252Z Description: No description available.
CVE ID: CVE-2016-1000367 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T16:12:28.719Z Description: No description available.
CVE ID: CVE-2016-1000368 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T20:41:34.834Z Description: No description available.
CVE ID: CVE-2016-1000369 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T20:57:58.659Z Description: No description available.
CVE ID: CVE-2016-1000370 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-17T04:08:44.267Z Description: No description available.
CVE ID: CVE-2016-1000371 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T16:53:09.925Z Description: No description available.
CVE ID: CVE-2016-1000372 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T19:10:33.331Z Description: No description available.
CVE ID: CVE-2016-1000373 State: REJECTED Published: 2017-05-07T07:31:00Z Last Updated: 2024-09-16T17:44:06.372Z Description: No description available.
CVE ID: CVE-2016-1000393 State: REJECTED Published: 2017-05-07T20:00:00Z Last Updated: 2024-09-16T20:37:07.212Z Description: No description available.
CVE ID: CVE-2016-10002 State: PUBLISHED Published: 2017-01-27T17:00:00 Last Updated: 2024-08-06T03:07:31.821Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information. Additional Analyst Notes: - CVE Program Container: References: - http://www.squid-cache.org/Advisories/SQUID-2016_11.txt - http://www.securitytracker.com/id/1037513 - http://www.openwall.com/lists/oss-s
cache.org/Advisories/SQUID-2016_11.txt - http://www.securitytracker.com/id/1037513 - http://www.openwall.com/lists/oss-security/2016/12/18/1 - http://rhn.redhat.com/errata/RHSA-2017-0183.html - http://rhn.redhat.com/errata/RHSA-2017-0182.html - http://www.securityfocus.com/bid/94953 - http://www.debian.org/security/2016/dsa-3745
CVE ID: CVE-2016-10003 State: PUBLISHED Published: 2017-01-27T17:00:00 Last Updated: 2024-08-06T03:07:31.873Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/12/18/1 - http://www.securitytracker.com/id/1037512 - http://www.securityfocus.com/bid/94953 - http://www.squid-cache.org/Advisories/SQUID-2016_10.txt