Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/rf5230a049d989dbfdd404b4320a265dceeeba459a4d04ec21873bd55%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/r7af60fbd8b2350d49d14e53a3ab2801998b9d1af2d6fcac60b060a53%40%3Cdev.brooklyn.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://lists.apache.org/thread.html/308cc15f1f1dc53e97046fddbac240e6cd16de89a2746cf257be7f5b%40%3Cdev.commons.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html
0.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://security.netapp.com/advisory/ntap-20230818-0001/
CVE ID: CVE-2019-12403 State: REJECTED Published: 2019-11-18T20:22:05 Last Updated: 2019-11-18T20:22:05 Description: No description available.
CVE ID: CVE-2019-12404 State: PUBLISHED Published: 2019-09-23T14:54:35 Last Updated: 2024-08-04T23:17:40.002Z Vendors: n/a Products: Apache JSPWiki Problem Types: Information Disclosure Description: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Additional Analyst Notes: - CVE Program Container: References: - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12404
CVE ID: CVE-2019-12405 State: PUBLISHED Published: 2019-09-09T16:36:25 Last Updated: 2024-08-04T23:17:40.016Z Vendors: Apache Products: Traffic Control Problem Types: Improper Authentication Description: Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/e128e9d382f3b0d074e2b597ac58e1d92139394509d81ddbc9e3700e%40%3Cusers.trafficcontrol.apac
s://lists.apache.org/thread.html/e128e9d382f3b0d074e2b597ac58e1d92139394509d81ddbc9e3700e%40%3Cusers.trafficcontrol.apache.org%3E - https://support.f5.com/csp/article/K84141859 - https://support.f5.com/csp/article/K84141859?utm_source=f5support&amp%3Butm_medium=RSS - https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E - https://lists.apache.org/thread.html/rc8bfd7d4f71d61e9193efcd4699eccbab3c202ec1d75ed9d502f08bf%40%3Ccommits.trafficcontrol.apache.org%3E
CVE ID: CVE-2019-12406 State: PUBLISHED Published: 2019-11-06T20:07:27 Last Updated: 2024-08-04T23:17:40.123Z Vendors: n/a Products: Apache CXF Problem Types: Denial of Service Description: Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count". Additional Analyst Notes: - CVE Program Container: References: - https
via the message property "attachment-max-count". Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://lists.apache.org/thread.html/rb2a6dab1f781f55326543c56dc29ea677759439ddfeba920c
ecurity-alerts/cpujan2020.html - https://lists.apache.org/thread.html/rb2a6dab1f781f55326543c56dc29ea677759439ddfeba920c83037e6%40%3Cissues.cxf.apache.org%3E - https://lists.apache.org/thread.html/r92238967ba2783d3ab5a483f2e17f5fdaa8ace98990f69f9e8e15de0%40%3Cissues.cxf.apache.org%3E - https://lists.apache.org/thread.html/rabc395b38acb7f2465bfbf0bc16d6e1e95720c89bea87abe8808eeea%40%3Cissues.cxf.apache.org%3E - https://lists.apache.org/thread.html/rca465c9d1e1969281338522b76701c85a07abd045c494261137236e0%40%3Cissues.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread
49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - http://cxf.apache.org/security-advisories.data/CVE-2019-12406.txt.asc - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2019-12407 State: PUBLISHED Published: 2019-09-23T15:40:59 Last Updated: 2024-08-04T23:17:40.131Z Vendors: n/a Products: Apache JSPWiki Problem Types: Information Disclosure Description: On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Additional Analyst Notes: - CVE Program Container: References: - https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-12407
CVE ID: CVE-2019-12408 State: PUBLISHED Published: 2019-11-08T18:20:16 Last Updated: 2024-08-04T23:17:40.239Z Vendors: Apache Software Foundation Products: Apache Arrow Problem Types: Information Disclosure Description: It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats. Additional Analyst Notes: - CVE Program Container: References: - htt
or persisted in the streaming IPC and file formats. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E - https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073%40%3Cannounce.apache.org%3E
CVE ID: CVE-2019-12409 State: PUBLISHED Published: 2019-11-18T20:50:59 Last Updated: 2024-08-04T23:17:39.994Z Vendors: Apache Products: Solr Problem Types: Remote Code Execution Description: The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which ma
nbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/6640c7e370fce2b74e466a605a46244ccc40666ad9e3064a4e04a85d%40%3Csolr-user.lucene.apache.org%3E - https://lists.apache.org/thread.html/ce7c0b456b15f6c7518adefa54ec948fed6de8e951a2584500c1e541%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/925cdb49ceae78baddb45da7beb9b4d2b1ddc4a8e318c65e91fb4e87%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/a044eae4
db45da7beb9b4d2b1ddc4a8e318c65e91fb4e87%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/a044eae4f6f5b0160ece5bf9cc4c0dad90ce7dd9bb210a9dc50b54be%40%3Cgeneral.lucene.apache.org%3E - https://lists.apache.org/thread.html/47e112035b4aa67ece3b75dbcd1b9c9212895b9dfe2a71f6f7c174e2%40%3Cannounce.apache.org%3E - https://support.f5.com/csp/article/K23720587?utm_source=f5support&amp%3Butm_medium=RSS - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-12409-RCE%20Vulnerability%20Due%20to%20Bad%20Defalut%20Config-Apache%20Solr
CVE ID: CVE-2019-12410 State: PUBLISHED Published: 2019-11-08T18:04:52 Last Updated: 2024-08-04T23:17:40.008Z Vendors: Apache Software Foundation Products: Apache Arrow Problem Types: Information Disclosure Description: While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats. Additional Analyst Notes: - CVE Program Co
for instance with Flight) or persisted in the streaming IPC and file formats. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/11/08/1 - https://lists.apache.org/thread.html/49f067b1c5fb7493d952580f0d2d032819ba351f7a78743c21126269%40%3Cdev.arrow.apache.org%3E - https://lists.apache.org/thread.html/efd8bbf57427d3c303b5316d208a335f8d0c0dbe0dc4c87cfa995073%40%3Cannounce.apache.org%3E
CVE ID: CVE-2019-12411 State: REJECTED Published: 2020-10-15T15:03:00 Last Updated: 2020-10-15T15:03:00 Description: No description available.
CVE ID: CVE-2019-12412 State: PUBLISHED Published: 2020-11-18T23:16:50 Last Updated: 2024-08-04T23:17:39.994Z Vendors: n/a Products: libapreq2 Problem Types: NULL pointer dereference Description: A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remote attacker could send a request causing a process crash which could lead to a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/939937 - https://lists.apache.org/thread.html/rce5814279a615d4a17c870a3c5b77f57975874d382ffee0b73b7f9da%40%3Cmodperl.perl.apache.org%3E
CVE ID: CVE-2019-12413 State: PUBLISHED Published: 2019-12-16T21:53:26 Last Updated: 2024-08-04T23:17:40.060Z Vendors: n/a Products: Apache Incubator Superset Problem Types: Information Disclosure Description: In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/85ab04f8c52df8c353ecfa0ecd2ff27fc07fb8ab7566a754349806be%40%3Cdev.superset.apache.org%3E
CVE ID: CVE-2019-12414 State: PUBLISHED Published: 2019-12-16T21:52:57 Last Updated: 2024-08-04T23:17:40.135Z Vendors: n/a Products: Apache Incubator Superset Problem Types: Information Disclosure Description: In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/396034aabe08dd349ff44eb062c718aadcf1b4e86f6372c7d5e988c0%40%3Cdev.superset.apache.org%3E
CVE ID: CVE-2019-12415 State: PUBLISHED Published: 2019-10-23T19:27:20 Last Updated: 2024-08-04T23:17:40.071Z Vendors: n/a Products: Apache POI Problem Types: Information Disclosure Description: In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E - https://lists.apache.org/thread.
2ac0327748de0c2b3c1c012481b79936797c711724e0b7da83cf564c%40%3Cuser.tika.apache.org%3E - https://lists.apache.org/thread.html/895164e03a3c327449069e2fd6ced0367561878b3ae6a8ec740c2007%40%3Cuser.tika.apache.org%3E - https://lists.apache.org/thread.html/d88b8823867033514d7ec05d66f88c70dc207604d3dcbd44fd88464c%40%3Cuser.tika.apache.org%3E - https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujul2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://lists.apache.org/thread.html/13a54b6a03369cfb418a6
ml - https://www.oracle.com/security-alerts/cpujan2020.html - https://lists.apache.org/thread.html/13a54b6a03369cfb418a699180ffb83bd727320b6ddfec198b9b728e%40%3Cannounce.apache.org%3E - https://www.oracle.com/security-alerts/cpuoct2020.html - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2019-12416 State: PUBLISHED Published: 2020-03-19T14:48:52 Last Updated: 2024-08-04T23:17:40.117Z Vendors: n/a Products: Apache DeltaSpike Problem Types: JavaScript Injection Description: we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r8f327712b2b07f867fde1e77cbafcf8cc6a3facaa693ffdd2c3285e3%40%3Cdev.deltaspike.apache.org%3E - https://lists.apache.org/thread.html/r848d7d4c0bf637da55f01103eb8ba0fce344c295fda53264cbaa1568%40%3Ccommits.camel.apache.org%
://lists.apache.org/thread.html/r848d7d4c0bf637da55f01103eb8ba0fce344c295fda53264cbaa1568%40%3Ccommits.camel.apache.org%3E
CVE ID: CVE-2019-12417 State: PUBLISHED Published: 2019-10-30T21:04:32 Last Updated: 2024-08-04T23:17:40.098Z Vendors: n/a Products: Apache Airflow Problem Types: Stored XSS and Local File Disclosure Description: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc%40%3Cusers.airflow.apache.org%3E
CVE ID: CVE-2019-12418 State: PUBLISHED Published: 2019-12-23T17:12:43 Last Updated: 2024-08-04T23:17:40.118Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Local Privilege Escalation Description: When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E - https://www.debian.org/security/2019/dsa-4596 - https://seclists.org/bugtraq/2019/Dec/43 - https://security.netapp.com/advisory/ntap-20200107-0001/ - https://support.f5.com/csp/article/K10107360?utm_source=f5support&amp%3Butm_medium=RSS - http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html - https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html -
/opensuse-security-announce/2020-01/msg00013.html - https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html - https://usn.ubuntu.com/4251-1/ - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r
af4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E - https://security.gentoo.org/glsa/202003-43 - https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.debian.org/security/2020/dsa-4680
CVE ID: CVE-2019-12419 State: PUBLISHED Published: 2019-11-06T20:18:54 Last Updated: 2024-08-04T23:17:40.005Z Vendors: Apache Products: Apache CXF Problem Types: Apache CXF OpenId Connect token service does not properly validate the clientId Description: Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vuln
cious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.orac
738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpujan2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html - http://cxf.apache.org/security-advisories.data/CVE-2019-12419.txt.asc - https://lists.apache.org/thread.html/ree5fc719e330f82ae38a2b0050c91f18ed5b878312dc0b9e0b9815be%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/r861eb1a9e0250e9150215b17f0263edf62becd5e20fc96251cff59f6%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/re7593a274ee0a85d304d5d42c66fc0081c94d7f22bc96a1084d43b80%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/r
3a274ee0a85d304d5d42c66fc0081c94d7f22bc96a1084d43b80%40%3Cdev.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://www.oracle.com/security-alerts/cpuApr2021.html - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2019-12420 State: PUBLISHED Published: 2019-12-12T22:16:05 Last Updated: 2024-08-04T23:17:40.097Z Vendors: Apache Products: Apache SpamAssassin Problem Types: Denial of Service via excessive resource utilization Description: In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended fix but details will not be shared publicly. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/64cf76749956dd08f7d5b86ec9f3321f382cfd7fe717ccd1be940c92%40%3Cannounce.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/e3c2367351286b77a74
fd7fe717ccd1be940c92%40%3Cannounce.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/e3c2367351286b77a74a082e2b66b793cceefa7b6ea9dcd162db4c4b%40%3Cdev.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/5ef362d6da12126fafc81443309ca95d872d1bfd011fe4b2699f0fe9%40%3Cusers.spamassassin.apache.org%3E - http://www.openwall.com/lists/oss-security/2019/12/12/2 - https://lists.apache.org/thread.html/5863d6c42fc9595a29566732f12348cde0ca0e41bda91695c62041de%40%3Cannounce.apache.org%3E - https://svn.apache.org/repos/asf/spamassassin/branches/3.4/build/announcements/3.4.3.txt - https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7747 - https://www.debian.org/security/2019/ds
ouncements/3.4.3.txt - https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7747 - https://www.debian.org/security/2019/dsa-4584 - https://seclists.org/bugtraq/2019/Dec/27 - https://lists.debian.org/debian-lts-announce/2019/12/msg00019.html - https://usn.ubuntu.com/4237-1/ - https://usn.ubuntu.com/4237-2/ - https://lists.apache.org/thread.html/r2578c486552637bfedbe624940cc60d6463bd90044c887bdebb75e74%40%3Cusers.spamassassin.apache.org%3E - https://lists.apache.org/thread.html/r3d32ebf97b1245b8237763444e911c4595d2ad5e34a1641840d8146f%40%3Cusers.spamassassin.apache.org%3E
CVE ID: CVE-2019-12421 State: PUBLISHED Published: 2019-11-19T21:33:12 Last Updated: 2024-08-04T23:17:40.174Z Vendors: n/a Products: Apache NiFi Problem Types: Authentication Description: When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi. Additional Analyst Notes: - CVE Program Container: References: - https://nifi.apache.org/security.html#CVE-2019-12421 - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b2
ttps://nifi.apache.org/security.html#CVE-2019-12421 - https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E