Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
//security.netapp.com/advisory/ntap-20181014-0001/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us - https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669 - https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2017-7659 State: PUBLISHED Published: 2017-07-26T21:00:00 Last Updated: 2024-08-05T16:12:27.873Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: n/a Description: A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208221 - https://access.redhat.com/errata/RHSA-2017:2483 - https://security.netapp.com/advisory/ntap-20180601-0002/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us - https://lists.apache.org/t
ps://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us - https://lists.apache.org/thread.html/1d0b746bbaa3a64890fcdab59ee9050aaa633b7143e7d412374e5a9a%40%3Cannounce.httpd.apache.org%3E - http://www.securityfocus.com/bid/99132 - http://www.debian.org/security/2017/dsa-3896 - http://www.securitytracker.com/id/1038711 - https://security.gentoo.org/glsa/201710-32 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - ht
ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c99
a464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thr
ml/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2017-7660 State: PUBLISHED Published: 2017-07-07T19:00:00Z Last Updated: 2024-09-16T18:13:03.269Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: Information Disclosure Description: Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plu
BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://security.netapp.com/advisory/ntap-20181127-0003/ - http://mail-archives.us.apache.org/mod_mbox/www-announce/201707.mbox/%3CCAOOKt53EgrybaD%2BiSn-nBbvFdse-szhg%3DhMoDZuvUvyMme-Z%3Dg%40mail.gmail.com%3E - http://www.securityfocus.com/bid/99485
CVE ID: CVE-2017-7661 State: PUBLISHED Published: 2017-05-16T17:00:00 Last Updated: 2024-08-05T16:12:27.800Z Vendors: Apache Software Foundation Products: Apache CXF Fediz Problem Types: Cross Site Request Forgery Description: Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4. Additional Analyst Notes: - CVE Program Container: References: - http://cxf.apache.org/security-advisories.data/CVE-2017-7661.txt.asc - http://www.securitytracker.com/id/1038497 - http
http://cxf.apache.org/security-advisories.data/CVE-2017-7661.txt.asc - http://www.securitytracker.com/id/1038497 - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7
bcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2017-7662 State: PUBLISHED Published: 2017-05-16T17:00:00 Last Updated: 2024-08-05T16:12:27.730Z Vendors: Apache Software Foundation Products: Apache CXF Fediz Problem Types: Cross Site Request Forgery Description: Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registr
eb application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active. Additional Analyst Notes: - CVE Program Container: References: - http://cxf.apache.org/security-advisories.data/CVE-2017-7662.txt.asc - http://www.securitytracker.com/id/1038498 - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40
ts.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2017-7663 State: PUBLISHED Published: 2017-07-14T15:00:00Z Last Updated: 2024-09-17T03:08:15.636Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: XSS Description: Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99577 - http://markmail.org/message/aka2z2dq7icfw2p2
CVE ID: CVE-2017-7664 State: PUBLISHED Published: 2017-07-14T15:00:00Z Last Updated: 2024-09-16T23:36:16.238Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: XML Validation Description: Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99576 - http://markmail.org/message/cwr552iapmhukb45
CVE ID: CVE-2017-7665 State: PUBLISHED Published: 2017-06-12T16:00:00 Last Updated: 2024-08-05T16:12:27.928Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Information Disclosure Description: In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99009 - https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E
CVE ID: CVE-2017-7666 State: PUBLISHED Published: 2017-07-14T15:00:00Z Last Updated: 2024-09-16T18:39:41.477Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: CSRF Description: Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. Additional Analyst Notes: - CVE Program Container: References: - http://markmail.org/message/fkesu4e5hhz5xdbg
CVE ID: CVE-2017-7667 State: PUBLISHED Published: 2017-06-12T16:00:00 Last Updated: 2024-08-05T16:12:27.709Z Vendors: Apache Software Foundation Products: Apache NiFi Problem Types: Information Disclosure Description: Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99018 - https://lists.apache.org/thread.html/d779d6129de1a5aa149c219b2fc6e9e78156614eaac92a89cbaf9bce%40%3Cdev.nifi.apache.org%3E
CVE ID: CVE-2017-7668 State: PUBLISHED Published: 2017-06-20T01:00:00 Last Updated: 2024-08-05T16:12:28.098Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-126 Description: The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value. Additional Analyst Notes: - CVE Program Container: References: - https://support.apple.com/HT208221 - https://access.redhat.com/errata/RH
t Notes: - CVE Program Container: References: - https://support.apple.com/HT208221 - https://access.redhat.com/errata/RHSA-2017:2479 - https://lists.apache.org/thread.html/55a068b6a5eec0b3198ae7d96a7cb412352d0ffa7716612c5af3745b%40%3Cdev.httpd.apache.org%3E - https://access.redhat.com/errata/RHSA-2017:2483 - https://security.netapp.com/advisory/ntap-20180601-0002/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.securityfocus.com/bid/99137 - http://www.debian.
.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.securityfocus.com/bid/99137 - http://www.debian.org/security/2017/dsa-3896 - https://access.redhat.com/errata/RHSA-2017:3194 - https://access.redhat.com/errata/RHSA-2017:3193 - http://www.securitytracker.com/id/1038711 - https://security.gentoo.org/glsa/201710-32 - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apa
rg%3E - https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apa
g/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3
Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc445
6340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2017-7669 State: PUBLISHED Published: 2017-06-02T17:00:00 Last Updated: 2024-08-05T16:12:27.980Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: Privilege escalation Description: In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98795 - https://mail-archives.apache.org/mod_mbox/hadoop-user/201706.mbox/%3C4A2FDA56-491B-4C2A-915F-C9D4A4BDB92A%40apache.org%3E
CVE ID: CVE-2017-7670 State: PUBLISHED Published: 2017-07-10T18:00:00Z Last Updated: 2024-09-16T17:52:59.730Z Vendors: Apache Software Foundation Products: Apache Traffic Control Problem Types: Denial of Service Description: The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the threa
definitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/42b207e9f526353b504591684bd02a5e9fcb4b8f28534253d07740a0%40%3Cusers.trafficcontrol.apache.org%3E - https://lists.apache.org/thread.html/bb09fc29e9c2ee85b118a3d5748a8a523d30cf691ff8b606c6a1748c%40%3Ccommits.trafficcontrol.apache.org%3E - https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb
ficcontrol.apache.org%3E - https://lists.apache.org/thread.html/r3c675031ac220b5eae64a9c84a03ee60045c6045738607dca4a96cb8%40%3Ccommits.trafficcontrol.apache.org%3E
CVE ID: CVE-2017-7671 State: PUBLISHED Published: 2018-02-27T20:00:00Z Last Updated: 2024-09-16T22:09:57.141Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: Information Disclosure Description: There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TLS handshake. This issue can cause the server to coredump. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4128 - https://lists.apache.org/thread.html/203bdcf9bbb718f3dc6f7aaf3e2af632474d51fa9e7bfb7832729905%40%3Cdev.trafficserver.apache.org%3E
CVE ID: CVE-2017-7672 State: PUBLISHED Published: 2017-07-13T15:00:00Z Last Updated: 2024-09-17T01:41:33.467Z Vendors: Apache Software Foundation Products: Apache Struts Problem Types: DoS Attack Description: If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/alert-cve-2017-9805-3889403.html - http://www.securityfocus.com/bid/99563 - http://struts.apache.org/doc
curity-advisory/alert-cve-2017-9805-3889403.html - http://www.securityfocus.com/bid/99563 - http://struts.apache.org/docs/s2-047.html - https://security.netapp.com/advisory/ntap-20180706-0002/ - http://www.securitytracker.com/id/1039114 - https://lists.apache.org/thread.html/3795c4dd46d9ec75f4a6eb9eca11c11edd3e796c6c1fd7b17b5dc50d%40%3Cannouncements.struts.apache.org%3E
CVE ID: CVE-2017-7673 State: PUBLISHED Published: 2017-07-14T15:00:00 Last Updated: 2024-08-05T16:12:27.911Z Vendors: Apache Software Foundation Products: Apache OpenMeetings Problem Types: n/a Description: Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection. Additional Analyst Notes: - CVE Program Container: References: - http://markmail.org/message/3hshl26omwjo6c5i - http://www.securityfocus.com/bid/99587
CVE ID: CVE-2017-7674 State: PUBLISHED Published: 2017-08-11T02:00:00Z Last Updated: 2024-09-17T03:47:49.467Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Cache Poisoning Description: The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us - https://access.redhat.com/errata/RHSA-2017:1
om/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03828en_us - https://access.redhat.com/errata/RHSA-2017:1801 - https://lists.apache.org/thread.html/22b4bb077502f847e2b9fcf00b96e81e734466ab459780ff73b60c0f%40%3Cannounce.tomcat.apache.org%3E - https://security.netapp.com/advisory/ntap-20180614-0003/ - http://www.securityfocus.com/bid/100280 - http://www.debian.org/security/2017/dsa-3974 - http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html - https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html - https://access.redhat.com/errata/RHSA-2017:1802 - https://access.redhat.com/errata/RHSA-2017:3081 - https://lists.apache.org/thread.html/eb6efa8d59c
rata/RHSA-2017:1802 - https://access.redhat.com/errata/RHSA-2017:3081 - https://lists.apache.org/thread.html/eb6efa8d59c45a7a9eff94c4b925467d3b3fec8ba7697f3daa314b04%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5c0e00fd31efc11e147bf99d0f03c00a734447d3b131ab0818644cdb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E
s://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/e85e83e9954f169bbb77b44baae5a33d8de878df557bb32b7f793661%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/1dd0a59c1295cc08ce4c9e7edae5ad2268acc9ba55adcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf181
dcefa0532e5ba%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r15695e6203b026c9e9070ca9fa95fb17dd4cd88e5342a7dc5e1e7b85%40%3Cusers.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E - https://lists.apach