Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14621 - http://git.linux-nfs.org/?p=steved/libtirpc.git%3Ba=commit%3Bh=fce98161d9815ea016855d9f00274276452c2c4b - https://bugzilla.novell.com/show_bug.cgi?id=968175
CVE ID: CVE-2018-14622 State: PUBLISHED Published: 2018-08-30T13:00:00 Last Updated: 2024-08-05T09:29:51.941Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: libtirpc Problem Types: CWE-252 Description: A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xprt() was not checked in all instances, which could lead to a crash when the server exhausted the maximum number of available file descriptors. A remote attacker could cause an rpc-based application to crash by flooding it with new connections. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubun
h by flooding it with new connections. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3759-2/ - https://usn.ubuntu.com/3759-1/ - https://access.redhat.com/errata/RHBA-2017:1991 - https://lists.debian.org/debian-lts-announce/2018/08/msg00034.html - https://bugzilla.novell.com/show_bug.cgi?id=968175 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14622 - http://git.linux-nfs.org/?p=steved/libtirpc.git%3Ba=commit%3Bh=1c77f7a869bdea2a34799d774460d1f9983d45f0
CVE ID: CVE-2018-14623 State: PUBLISHED Published: 2018-12-13T22:00:00 Last Updated: 2024-08-05T09:29:51.865Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: The Foreman Project Products: katello Problem Types: CWE-89, CWE-209 Description: A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1
Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14623 - http://www.securityfocus.com/bid/106224
CVE ID: CVE-2018-14624 State: PUBLISHED Published: 2018-09-06T13:00:00 Last Updated: 2024-08-05T09:29:51.694Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: 389-ds-base Problem Types: CWE-20 Description: A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2757 - https://pagure.io
nalyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2757 - https://pagure.io/389-ds-base/issue/49937 - https://lists.debian.org/debian-lts-announce/2018/09/msg00037.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14624 - http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html
CVE ID: CVE-2018-14625 State: PUBLISHED Published: 2018-09-10T13:00:00 Last Updated: 2024-08-05T09:29:51.690Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: [UNKNOWN] Products: kernel Problem Types: CWE-416 Description: A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat
ages destined to other clients. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14625 - https://usn.ubuntu.com/3872-1/ - https://usn.ubuntu.com/3878-1/ - https://usn.ubuntu.com/3871-5/ - https://usn.ubuntu.com/3878-2/ - https://usn.ubuntu.com/3871-4/ - https://syzkaller.appspot.com/bug?extid=bd391451452fb0b93039 - https://usn.ubuntu.com/3871-1/ - https://usn.ubuntu.com/3871-3/ - https://lists.debian.org/debian-lts-announce/2019/05/msg00002.html - https://access.redhat.com/errata/RHSA-2019:2043 - https://access.redhat.com/errata/RHSA-2019:2029 - https://access.redhat.com/errata/RHSA-2019:4154
CVE ID: CVE-2018-14626 State: PUBLISHED Published: 2018-11-29T18:00:00 Last Updated: 2024-08-05T09:29:51.834Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: The PowerDNS Project Products: pdns, pdns-recursor Problem Types: CWE-400 Description: PowerDNS Authoritative Server 4.1.0 up to 4.1.4 inclusive and PowerDNS Recursor 4.0.0 up to 4.1.4 inclusive are vulnerable to a packet cache pollution via crafted query that can lead to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14626 - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html - htt
w_bug.cgi?id=CVE-2018-14626 - https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2018-06.html - https://doc.powerdns.com/authoritative/security-advisories/powerdns-advisory-2018-05.html
CVE ID: CVE-2018-14627 State: PUBLISHED Published: 2018-09-04T12:00:00 Last Updated: 2024-08-05T09:29:51.696Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: JBoss/WildFly Problem Types: CWE-319 Description: The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality="required" trust-in-target="supported"/> Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1
Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14627 - https://access.redhat.com/errata/RHSA-2018:3528 - https://access.redhat.com/errata/RHSA-2018:3527 - https://issues.jboss.org/browse/WFLY-9107 - https://security.netapp.com/advisory/ntap-20181221-0002/ - https://access.redhat.com/errata/RHSA-2018:3595 - https://access.redhat.com/errata/RHSA-2018:3529
CVE ID: CVE-2018-14628 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-02-13T16:27:16.302Z Vendors: n/a Products: Samba Problem Types: CWE-862 Description: An information leak vulnerability was discovered in Samba's LDAP server. Due to missing access control checks, an authenticated but unprivileged attacker could discover the names and preserved attributes of deleted objects in the LDAP store. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.samba.org/show_bug.cgi?id=13595 - https://bugzilla.redhat.com/show_bug.cgi?id=1625445 - http://www.openwall.com/lists/oss-security/2023/11/28/4 - https://lists.fedoraproject.org/archives/list/pack
d=1625445 - http://www.openwall.com/lists/oss-security/2023/11/28/4 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6DK57HQRTCDOZDIIICYWQ4Z5IQXTWVVW/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ACVMYEP5KJRL3FWSCZW2MQZ26IVPXY62/
CVE ID: CVE-2018-14629 State: PUBLISHED Published: 2018-11-28T14:00:00 Last Updated: 2024-08-05T09:29:51.868Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: samba Problem Types: CWE-400 Description: A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3827-2/ - https://usn.ubuntu.com/3827-1/ - http://www.securityfocus.com/bid/106022 - https://s
- https://usn.ubuntu.com/3827-2/ - https://usn.ubuntu.com/3827-1/ - http://www.securityfocus.com/bid/106022 - https://security.netapp.com/advisory/ntap-20181127-0001/ - https://lists.debian.org/debian-lts-announce/2018/12/msg00005.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14629 - https://www.debian.org/security/2018/dsa-4345 - https://www.samba.org/samba/security/CVE-2018-14629.html - https://security.gentoo.org/glsa/202003-52
CVE ID: CVE-2018-14630 State: PUBLISHED Published: 2018-09-17T18:00:00 Last Updated: 2024-08-05T09:29:51.675Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-20 Description: moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - http://w
importing questions from an untrusted source. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105354 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62880 - https://moodle.org/mod/forum/discuss.php?d=376023 - https://seclists.org/fulldisclosure/2018/Sep/28 - https://www.sec-consult.com/en/blog/advisories/remote-code-execution-php-unserialize-moodle-open-source-learning-platform-cve-2018-14630/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14630
CVE ID: CVE-2018-14631 State: PUBLISHED Published: 2018-09-17T20:00:00 Last Updated: 2024-08-05T09:29:51.898Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: moodle Problem Types: CWE-20 Description: moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.o
ng JavaScript in the search parameter. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=376025 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857 - http://www.securityfocus.com/bid/105371 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631
CVE ID: CVE-2018-14632 State: PUBLISHED Published: 2018-09-06T13:00:00 Last Updated: 2024-08-05T09:38:13.091Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Red Hat Products: atomic-openshift Problem Types: CWE-787 Description: An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14632 - https://github.com/evanphx/json
am Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14632 - https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03#diff-65c563bba473be9d94ce4d033f74810e - https://access.redhat.com/errata/RHBA-2018:2652 - https://access.redhat.com/errata/RHSA-2018:2654 - https://access.redhat.com/errata/RHSA-2018:2908 - https://access.redhat.com/errata/RHSA-2018:2906 - https://access.redhat.com/errata/RHSA-2018:2709
CVE ID: CVE-2018-14633 State: PUBLISHED Published: 2018-09-25T00:00:00 Last Updated: 2024-08-05T09:38:13.035Z Severity: HIGH (CVSS 7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-121 Description: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compile
iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3776-1/ - https://usn.ubuntu.com/3776-2/ - https://usn.ubuntu.com/3777-1/ - https://bugzilla.redhat.com/show
.ubuntu.com/3776-1/ - https://usn.ubuntu.com/3776-2/ - https://usn.ubuntu.com/3777-1/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14633 - https://usn.ubuntu.com/3775-1/ - https://seclists.org/oss-sec/2018/q3/270 - https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html - https://usn.ubuntu.com/3779-1/ - http://www.securityfocus.com/bid/105388 - https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.19/scsi-fixes&id=8c39e2699f8acb2e29782a834e56306da24937fe - https://access.redhat.com/errata/RHSA-2018:3666 - https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git/commit/?h=4.19/scsi-fixes&id=1816494330a83f2a064499d8ed2797045641f92c - https://www.deb
cm/linux/kernel/git/mkp/scsi.git/commit/?h=4.19/scsi-fixes&id=1816494330a83f2a064499d8ed2797045641f92c - https://www.debian.org/security/2018/dsa-4308 - https://access.redhat.com/errata/RHSA-2018:3651 - https://usn.ubuntu.com/3775-2/ - https://usn.ubuntu.com/3777-2/ - https://usn.ubuntu.com/3777-3/ - https://access.redhat.com/errata/RHSA-2019:1946
CVE ID: CVE-2018-14634 State: PUBLISHED Published: 2018-09-25T21:00:00 Last Updated: 2024-08-05T09:38:13.057Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-190 Description: An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3540 - https://security.n
alyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3540 - https://security.netapp.com/advisory/ntap-20190204-0002/ - https://access.redhat.com/errata/RHSA-2018:2925 - https://access.redhat.com/errata/RHSA-2018:3591 - https://www.exploit-db.com/exploits/45516/ - https://usn.ubuntu.com/3775-1/ - https://access.redhat.com/errata/RHSA-2018:2933 - https://usn.ubuntu.com/3779-1/ - https://access.redhat.com/errata/RHSA-2018:2748 - https://access.redhat.com/errata/RHSA-2018:3590 - https://usn.ubuntu.com/3775-2/ - https://access.redhat.com/errata/RHSA-2018:2763 - http://www.securityfocus.com/bid/105407 - https://access.redhat.com/errata/RHSA-2018:2924 - htt
/errata/RHSA-2018:2763 - http://www.securityfocus.com/bid/105407 - https://access.redhat.com/errata/RHSA-2018:2924 - https://access.redhat.com/errata/RHSA-2018:3586 - https://access.redhat.com/errata/RHSA-2018:3643 - https://access.redhat.com/errata/RHSA-2018:2846 - https://www.openwall.com/lists/oss-security/2018/09/25/4 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14634 - https://support.f5.com/csp/article/K20934447?utm_source=f5support&amp%3Butm_medium=RSS - https://security.paloaltonetworks.com/CVE-2018-14634 - http://www.openwall.com/lists/oss-security/2021/07/20/2
CVE ID: CVE-2018-14635 State: PUBLISHED Published: 2018-09-10T19:00:00 Last Updated: 2024-08-05T09:38:12.947Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: The Openstack Project Products: openstack-neutron Problem Types: CWE-20 Description: When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable. Additio
the allowed allocation pool. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2710 - https://access.redhat.com/errata/RHSA-2018:2715 - https://bugs.launchpad.net/neutron/+bug/1757482 - https://access.redhat.com/errata/RHSA-2018:2721 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14635 - https://access.redhat.com/errata/RHSA-2018:3792 - https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d
CVE ID: CVE-2018-14636 State: PUBLISHED Published: 2018-09-10T19:00:00 Last Updated: 2024-08-05T09:38:13.238Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: The Openstack Project Products: openstack-neutron Problem Types: CWE-300 Description: Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due to the Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration br
e Open vSwitch integration bridge being connected to the instance during migration. When connected to the integration bridge, all traffic for instances using the same Open vSwitch instance would potentially be visible to the migrated guest, as the required Open vSwitch VLAN filters are only applied post-migration. Versions of openstack-neutron before 13.0.0.0b2, 12.0.3, 11.0.5 are vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/neutron/+bug/1767422 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14636 - https://bugs.launchpad.net/neutron/+bug/1734320
CVE ID: CVE-2018-14637 State: PUBLISHED Published: 2018-11-30T13:00:00 Last Updated: 2024-08-05T09:38:12.558Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: keycloak Problem Types: CWE-287, CWE-285 Description: The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14637
CVE ID: CVE-2018-14638 State: PUBLISHED Published: 2018-09-14T19:00:00 Last Updated: 2024-08-05T09:38:13.183Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Fedora Project Products: 389-ds-base Problem Types: CWE-400 Description: A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:2757 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14638 - https://pagure.io/389-ds-base/c/78fc627ac
/RHSA-2018:2757 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14638 - https://pagure.io/389-ds-base/c/78fc627accacfa4061ce48977e22301f81ea8d73
CVE ID: CVE-2018-14639 State: REJECTED Published: 2021-06-18T14:00:22 Last Updated: 2021-06-18T14:00:22 Description: No description available.
CVE ID: CVE-2018-14640 State: REJECTED Published: 2021-10-28T13:17:55 Last Updated: 2021-10-28T13:17:55 Description: No description available.
CVE ID: CVE-2018-14641 State: PUBLISHED Published: 2018-09-18T13:00:00 Last Updated: 2024-08-05T09:38:12.826Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Linux Foundation Products: kernel Problem Types: CWE-456 Description: A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux kernel from 4.19-rc1 to 4.19-rc3 inclusive, which can cause a later system crash in ip_do_fragment(). With certain non-default, but non-rare, configuration of a victim host, an attacker can trigger this crash remotely, thus leading to a remote denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - https://g
, thus leading to a remote denial-of-service. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5d407b071dc369c26a38398326ee2be53651cfe4 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14641 - https://access.redhat.com/errata/RHSA-2018:2948 - https://seclists.org/oss-sec/2018/q3/248
CVE ID: CVE-2018-14642 State: PUBLISHED Published: 2018-09-18T13:00:00 Last Updated: 2024-08-05T09:38:12.577Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: undertow Problem Types: CWE-200 Description: An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14642 - https://access.redhat.com/errata/RHSA-2
iner: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14642 - https://access.redhat.com/errata/RHSA-2019:0364 - https://access.redhat.com/errata/RHSA-2019:0362 - https://access.redhat.com/errata/RHSA-2019:0365 - https://access.redhat.com/errata/RHSA-2019:0380 - https://access.redhat.com/errata/RHSA-2019:1107 - https://access.redhat.com/errata/RHSA-2019:1108 - https://access.redhat.com/errata/RHSA-2019:1106 - https://access.redhat.com/errata/RHSA-2019:1140
CVE ID: CVE-2018-14643 State: PUBLISHED Published: 2018-09-21T13:00:00 Last Updated: 2024-08-05T09:38:12.833Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: smart_proxy_dynflow Problem Types: CWE-592 Description: An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105375 - https://github.com/theforeman/smart_proxy_dynflow/pull/54 - https:
ferences: - http://www.securityfocus.com/bid/105375 - https://github.com/theforeman/smart_proxy_dynflow/pull/54 - https://access.redhat.com/errata/RHSA-2018:2733 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14643