Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-3607 State: PUBLISHED Published: 2018-01-08T19:00:00 Last Updated: 2024-08-06T10:50:17.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Additional Analyst Notes: - CVE Program Container: References: - http://shibboleth.net/community/advisories/secadv_20140919.txt - https://bugzilla.redhat.com/show_bug.cgi?id=1140438 - https://code.google.com/archive/p/vt-middleware/issues/22
19.txt - https://bugzilla.redhat.com/show_bug.cgi?id=1140438 - https://code.google.com/archive/p/vt-middleware/issues/227 - https://code.google.com/archive/p/vt-middleware/issues/226 - https://code.google.com/archive/p/vt-middleware/issues/228
CVE ID: CVE-2014-3608 State: PUBLISHED Published: 2014-10-06T14:00:00 Last Updated: 2024-08-06T10:50:17.772Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-1782.html - http://rhn.redhat.com/errata/RHSA-2014-1781.
Container: References: - http://rhn.redhat.com/errata/RHSA-2014-1782.html - http://rhn.redhat.com/errata/RHSA-2014-1781.html - https://bugs.launchpad.net/nova/+bug/1338830 - http://seclists.org/oss-sec/2014/q4/65 - http://www.securityfocus.com/bid/70220
CVE ID: CVE-2014-3609 State: PUBLISHED Published: 2014-09-11T18:00:00 Last Updated: 2024-08-06T10:50:17.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values." Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61320 - http://secunia.com/advisories/60179 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00025.html - http://www.ubuntu.com/usn/USN-2327-1 - http://www.debian.org/security/2015/dsa-3139 - http://lists.opensu
sg00025.html - http://www.ubuntu.com/usn/USN-2327-1 - http://www.debian.org/security/2015/dsa-3139 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00029.html - http://www.debian.org/security/2014/dsa-3014 - http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html - http://www.squid-cache.org/Advisories/SQUID-2014_2.txt - http://rhn.redhat.com/errata/RHSA-2014-1147.html - http://secunia.com/advisories/60334 - http://www.securityfocus.com/bid/69453 - http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9201.patch - http://secunia.com/advisories/61412
CVE ID: CVE-2014-3610 State: PUBLISHED Published: 2014-11-10T11:00:00 Last Updated: 2024-08-06T10:50:17.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1144883 - ht
dditional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1144883 - http://www.ubuntu.com/usn/USN-2491-1 - http://www.ubuntu.com/usn/USN-2418-1 - http://www.securityfocus.com/bid/70742 - http://www.ubuntu.com/usn/USN-2417-1 - https://github.com/torvalds/linux/commit/854e8bb1aa06c578c2c9145fa6bfe3680ef63b23 - http://www.debian.org/security/2014/dsa-3060 - http://rhn.redhat.com/errata/RHSA-2015-0869.html - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html - http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html - http://www.ubuntu.com/usn/USN-2394-1 - http://www.openwall.com/lists/oss-security/2014/1
nnounce/2015-03/msg00025.html - http://www.ubuntu.com/usn/USN-2394-1 - http://www.openwall.com/lists/oss-security/2014/10/24/9 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23
CVE ID: CVE-2014-3611 State: PUBLISHED Published: 2014-11-10T11:00:00 Last Updated: 2024-08-06T10:50:17.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2febc839133280d5a5e8e1179c94ea674489dae2 - http://www.ubuntu.com/usn/USN-2491-1 - http://www.ubuntu.com/usn/USN-2418-1 - http://www.ubuntu.com/usn
94ea674489dae2 - http://www.ubuntu.com/usn/USN-2491-1 - http://www.ubuntu.com/usn/USN-2418-1 - http://www.ubuntu.com/usn/USN-2417-1 - http://www.debian.org/security/2014/dsa-3060 - https://bugzilla.redhat.com/show_bug.cgi?id=1144878 - http://rhn.redhat.com/errata/RHSA-2015-0869.html - https://github.com/torvalds/linux/commit/2febc839133280d5a5e8e1179c94ea674489dae2 - http://www.ubuntu.com/usn/USN-2394-1 - http://rhn.redhat.com/errata/RHSA-2015-0284.html - http://www.openwall.com/lists/oss-security/2014/10/24/9 - http://rhn.redhat.com/errata/RHSA-2015-0126.html
CVE ID: CVE-2014-3612 State: PUBLISHED Published: 2015-08-24T14:00:00 Last Updated: 2024-08-06T10:50:17.971Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72513
s in usernames. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72513 - http://seclists.org/oss-sec/2015/q1/427 - http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt - http://rhn.redhat.com/errata/RHSA-2015-0137.html - http://rhn.redhat.com/errata/RHSA-2015-0138.html - https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
CVE ID: CVE-2014-3613 State: PUBLISHED Published: 2014-11-18T15:00:00 Last Updated: 2024-08-06T10:50:17.964Z Vendors: n/a Products: n/a Problem Types: n/a Description: cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - http://curl.haxx.se/docs/adv_20140910A.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
ttp://curl.haxx.se/docs/adv_20140910A.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://rhn.redhat.com/errata/RHSA-2015-1254.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html - http://www.securityfocus.com/bid/69748 - https://support.apple.com/kb/HT205031 - http://www.debian.org/security/2014/dsa-3022
CVE ID: CVE-2014-3614 State: PUBLISHED Published: 2014-09-19T14:00:00 Last Updated: 2024-08-06T10:50:17.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2014/q3/589 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95947 - http://secunia.com/advisories/61027 - http://blog.powerdns.com/2014/09/10/security-update-powerdns-recursor-3-6-1 - http://doc.powerdns.com/html/changelog.html
CVE ID: CVE-2014-3615 State: PUBLISHED Published: 2014-11-01T23:00:00 Last Updated: 2024-08-06T10:50:17.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69654 - https://bugzilla.redhat.com/show_bug.cgi?id=1139115 - http://rhn.redhat.com/errata/RHSA-2014-1941.html - http://rhn.redhat.com/errata/RHSA-2014-1669.html - http://www.debian.org/security/2014/dsa-3044 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ab9509cceabef28071e41bdfa073083859c949a7 - http://git.qemu.or
/dsa-3044 - http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=ab9509cceabef28071e41bdfa073083859c949a7 - http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=c1b886c45dc70f247300f549dce9833f3fa2def5 - http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html - http://rhn.redhat.com/errata/RHSA-2014-1670.html - http://secunia.com/advisories/61829 - http://support.citrix.com/article/CTX200892 - http://www.ubuntu.com/usn/USN-2409-1
CVE ID: CVE-2014-3616 State: PUBLISHED Published: 2014-12-08T11:00:00 Last Updated: 2024-08-06T10:50:17.280Z Vendors: n/a Products: n/a Problem Types: n/a Description: nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks. Additional Analyst Notes: - CVE Program Container: References: - http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html - http://www.debian.org/security/2014/dsa-3029
CVE ID: CVE-2014-3617 State: PUBLISHED Published: 2014-09-15T14:00:00 Last Updated: 2024-08-06T10:50:17.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: The forum_print_latest_discussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, and discover an author's username, by leveraging the student role and visiting a Q&A forum. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46619 -
es: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-46619 - http://openwall.com/lists/oss-security/2014/09/15/1 - https://moodle.org/mod/forum/discuss.php?d=269591
CVE ID: CVE-2014-3618 State: PUBLISHED Published: 2014-09-08T14:00:00 Last Updated: 2024-08-06T10:50:17.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes." Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00022.html - http://secunia.com/advisories/61108 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00008.html - http://www.debian.org/security/2014/dsa-3019 - htt
lists.opensuse.org/opensuse-security-announce/2014-09/msg00008.html - http://www.debian.org/security/2014/dsa-3019 - http://www.openwall.com/lists/oss-security/2014/09/03/8 - http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html - http://www.ubuntu.com/usn/USN-2340-1 - https://support.apple.com/HT205267 - http://rhn.redhat.com/errata/RHSA-2014-1172.html - http://linux.oracle.com/errata/ELSA-2014-1172.html - http://secunia.com/advisories/61090 - http://www.securityfocus.com/bid/69573 - http://secunia.com/advisories/61076 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95688
CVE ID: CVE-2014-3619 State: PUBLISHED Published: 2015-03-27T14:00:00 Last Updated: 2024-08-06T10:50:17.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header. Additional Analyst Notes: - CVE Program Container: References: - http://review.gluster.org/#/c/8662/4 - https://bugzilla.redhat.com/show_bug.cgi?id=1138145 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:211 - http://advisories.mageia.org/MGASA-2015-0145.html - http://lists.opensuse.org/opensuse-updates/2015-03/msg00031.html - http://lists.opensuse.org/o
rg/MGASA-2015-0145.html - http://lists.opensuse.org/opensuse-updates/2015-03/msg00031.html - http://lists.opensuse.org/opensuse-updates/2015-03/msg00056.html
CVE ID: CVE-2014-3620 State: PUBLISHED Published: 2014-11-18T15:00:00 Last Updated: 2024-08-06T10:50:17.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69742 - http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html - http://curl.haxx.se/docs/adv_20140910B.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.ht
net/InfoCenter/index?page=content&id=JSA10743 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html - https://support.apple.com/kb/HT205031 - http://www.debian.org/security/2014/dsa-3022 - http://www.openwall.com/lists/oss-security/2022/05/11/2
CVE ID: CVE-2014-3621 State: PUBLISHED Published: 2014-10-02T14:00:00 Last Updated: 2024-08-06T10:50:17.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-1789.html - http://rhn.redhat.com/errata/RHSA-2014-1688.html - http://www.openwall.com/lists/oss-security/2014/09/16/10 - http://www.ubuntu.com/usn/USN-240
rrata/RHSA-2014-1688.html - http://www.openwall.com/lists/oss-security/2014/09/16/10 - http://www.ubuntu.com/usn/USN-2406-1 - https://bugs.launchpad.net/keystone/+bug/1354208 - http://rhn.redhat.com/errata/RHSA-2014-1790.html
CVE ID: CVE-2014-3622 State: PUBLISHED Published: 2020-02-19T12:46:23 Last Updated: 2024-08-06T10:50:17.792Z Vendors: PHP Products: PHP Problem Types: Other Description: Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value. Additional Analyst Notes: - CVE Program Container: References: - http://php.net/ChangeLog-5.php - https://bugzilla.redhat.com/show_bug.cgi?id=1151423 - https://bugs.php.net/bug.php?id=68088
CVE ID: CVE-2014-3623 State: PUBLISHED Published: 2014-10-30T14:00:00 Last Updated: 2024-08-06T10:50:17.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70736 - http://rhn.redhat.com/errata/RHSA-2015-0675.html - http://seclists.org/oss-sec/2014/q4/437 - http://rhn.redhat.com/er
- http://rhn.redhat.com/errata/RHSA-2015-0675.html - http://seclists.org/oss-sec/2014/q4/437 - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://secunia.com/advisories/61909 - https://issues.apache.org/jira/browse/WSS-511 - http://rhn.redhat.com/errata/RHSA-2015-0851.html - http://rhn.redhat.com/errata/RHSA-2015-0236.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/97754 - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7
df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2014-3624 State: PUBLISHED Published: 2017-10-30T14:00:00 Last Updated: 2024-08-06T10:50:18.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/TS-2677 - http://mail-archives.apache.org/mod_mbox/www-announce/201411.mbox/%3C20141101231749.2E3561043F%40minotaur.apache.org%3E - http://www.securityfocus.com/bid/101630
CVE ID: CVE-2014-3625 State: PUBLISHED Published: 2014-11-20T17:00:00 Last Updated: 2024-08-06T10:50:17.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0720.html - http://www.pivotal.io/security/cve-2014-3625 - https://jira.spring.io/browse/SPR-12354 - http://rhn.redhat.com/errata/RHSA-2015-0236.html - https://lists.debian.org/d
https://jira.spring.io/browse/SPR-12354 - http://rhn.redhat.com/errata/RHSA-2015-0236.html - https://lists.debian.org/debian-lts-announce/2019/07/msg00012.html
CVE ID: CVE-2014-3626 State: PUBLISHED Published: 2018-03-19T13:00:00Z Last Updated: 2024-09-17T03:59:34.272Z Vendors: Dell EMC Products: Grails by Pivotal Problem Types: Directory Traversal Description: The Grails Resource Plugin often has to exchange URIs for resources with other internal components. Those other components will decode any URI passed to them. To protect against directory traversal the Grails Resource Plugin did the following: normalized the URI, checked the normalized URI did not step outside the appropriate root directory (e.g. the web application root), decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced wh
decoded the URI and checked that this did not introduce additional /../ (and similar) sequences. A bug was introduced where the Grails Resource Plugin before 1.2.13 returned the decoded version of the URI rather than the normalized version of the URI after the directory traversal check. This exposed a double decoding vulnerability. To address this issue, the Grails Resource Plugin now repeatedly decodes the URI up to three times or until decoding no longer changes the URI. If the decode limit of 3 is exceeded the URI is rejected. A side-effect of this is that the Grails Resource Plugin is unable to serve a resource that includes a '%' character in the full path to the resource. Not all envir
ource Plugin is unable to serve a resource that includes a '%' character in the full path to the resource. Not all environments are vulnerable because of the differences in URL resolving in different servlet containers. Applications deployed to Tomcat 8 and Jetty 9 were found not not be vulnerable, however applications deployed to JBoss EAP 6.3 / JBoss AS 7.4 and JBoss AS 7.1 were found to be vulnerable (other JBoss versions weren't tested). In certain cases JBoss returns JBoss specific vfs protocol urls from URL resolution methods (ClassLoader.getResources). The JBoss vfs URL protocol supports resolving any file on the filesystem. This made the directory traversal possible. There may be oth
URL protocol supports resolving any file on the filesystem. This made the directory traversal possible. There may be other containers, in addition to JBoss, on which this vulnerability is exposed. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2014-3626
CVE ID: CVE-2014-3627 State: PUBLISHED Published: 2014-12-05T16:00:00 Last Updated: 2024-08-06T10:50:17.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache. Additional Analyst Notes: - CVE Program Container: References: - http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40
//mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug%40mail.gmail.com%3E - http://secunia.com/advisories/60079 - http://secunia.com/advisories/60432
CVE ID: CVE-2014-3628 State: PUBLISHED Published: 2015-01-06T15:00:00 Last Updated: 2024-08-06T10:50:18.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62024 - http://mail-archives.us.apache.org/mod_mbox/www-announce/201412.mbox/%3C54A1A7C7.2070804%40apache.org%3E