Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
agick?cmd=changeset%3Bnode=b3eca3eaa264 - http://www.securityfocus.com/bid/101182 - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://nandynarwhals.org/CVE-2017-14994/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4232-1/
CVE ID: CVE-2017-14995 State: PUBLISHED Published: 2017-10-03T07:00:00 Last Updated: 2024-08-05T19:42:22.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257
CVE ID: CVE-2017-14997 State: PUBLISHED Published: 2017-10-03T07:00:00 Last Updated: 2024-08-05T19:42:22.383Z Vendors: n/a Products: n/a Problem Types: n/a Description: GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (excessive memory allocation) because of an integer underflow in ReadPICTImage in coders/pict.c. Additional Analyst Notes: - CVE Program Container: References: - http://hg.graphicsmagick.org/hg/GraphicsMagick?cmd=changeset%3Bnode=0683f8724200 - https://www.debian.org/security/2018/dsa-4321 - http://www.securityfocus.com/bid/101183 - https://sourceforge.net/p/graphicsmagick/bugs/511/ - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html -
ttps://sourceforge.net/p/graphicsmagick/bugs/511/ - https://lists.debian.org/debian-lts-announce/2018/08/msg00002.html - https://sourceforge.net/p/graphicsmagick/code/ci/0683f8724200495059606c03f04e0d589b33ebe8/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4232-1/
CVE ID: CVE-2017-15008 State: PUBLISHED Published: 2017-10-03T16:00:00Z Last Updated: 2024-09-17T02:12:17.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor version 17.3.33.2830 is vulnerable to stored Cross-Site Scripting on all sensor titles, related to incorrect error handling for a %00 in the SRC attribute of an IMG element. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b
CVE ID: CVE-2017-15009 State: PUBLISHED Published: 2017-10-03T16:00:00Z Last Updated: 2024-09-16T23:56:12.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: PRTG Network Monitor version 17.3.33.2830 is vulnerable to reflected Cross-Site Scripting on error.htm (the error page), via the errormsg parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/stolabs/security-issue-on-prtg-network-manager-ada65b45d37b
CVE ID: CVE-2017-15010 State: PUBLISHED Published: 2017-10-03T16:00:00 Last Updated: 2024-08-05T19:42:22.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2913 - https://nodesecurity.io/advisories/525 - http://www.securityfocus.com/bid/101185 - https://access.redhat.com/errata/RHSA-2018:1264 - https://access.redhat
/525 - http://www.securityfocus.com/bid/101185 - https://access.redhat.com/errata/RHSA-2018:1264 - https://access.redhat.com/errata/RHSA-2017:2912 - https://access.redhat.com/errata/RHSA-2018:1263 - https://github.com/salesforce/tough-cookie/issues/92 - https://snyk.io/vuln/npm:tough-cookie:20170905 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VEBDTGNHVM677SLZDEHMWOP3ISMZSFT/
CVE ID: CVE-2017-15011 State: PUBLISHED Published: 2017-10-03T20:00:00Z Last Updated: 2024-09-16T17:22:41.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: The named pipes in qtsingleapp in Qt 5.x, as used in qBittorrent and SugarSync, are configured for remote access and allow remote attackers to cause a denial of service (application crash) via an unspecified string. Additional Analyst Notes: - CVE Program Container: References: - https://hackinparis.com/data/slides/2017/2017_Cohen_Gil_The_forgotten_interface_Windows_named_pipes.pdf - https://www.youtube.com/watch?v=m6zISgWPGGY
CVE ID: CVE-2017-15012 State: PUBLISHED Published: 2017-10-13T16:00:00 Last Updated: 2024-08-05T19:42:22.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 does not properly validate the input of the PUT_FILE RPC-command, which allows any authenticated user to hijack an arbitrary file from the Content Server filesystem; because some files on the Content Server filesystem are security-sensitive, this leads to privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43003/ - http://www.securityfocus.com/bid/101639 - http://seclis
iner: References: - https://www.exploit-db.com/exploits/43003/ - http://www.securityfocus.com/bid/101639 - http://seclists.org/bugtraq/2017/Oct/19
CVE ID: CVE-2017-15013 State: PUBLISHED Published: 2017-10-13T16:00:00 Last Updated: 2024-08-05T19:42:22.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows an authenticated user to gain superuser privileges: Content Server stores information about uploaded files in dmr_content objects, which are queryable and "editable" (before release 7.2P02, any authenticated user was able to edit dmr_content objects; now any authenticated user may delete a dmr_content object and then create a new one with the old identifier) by authenticated users; this allow
er may delete a dmr_content object and then create a new one with the old identifier) by authenticated users; this allows any authenticated user to replace the content of security-sensitive dmr_content objects (for example, dmr_content related to dm_method objects) and gain superuser privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43004/ - http://www.securityfocus.com/bid/101639 - http://seclists.org/bugtraq/2017/Oct/19
CVE ID: CVE-2017-15014 State: PUBLISHED Published: 2017-10-13T16:00:00 Last Updated: 2024-08-05T19:42:22.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenText Documentum Content Server (formerly EMC Documentum Content Server) through 7.3 contains the following design gap, which allows authenticated users to download arbitrary content files regardless of the attacker's repository permissions: When an authenticated user uploads content to the repository, he performs the following steps: (1) calls the START_PUSH RPC-command; (2) uploads the file to the content server; (3) calls the END_PUSH_V2 RPC-command (here, Content Server returns a DATA_TICKET integer, intended to identi
nt server; (3) calls the END_PUSH_V2 RPC-command (here, Content Server returns a DATA_TICKET integer, intended to identify the location of the uploaded file on the Content Server filesystem); (4) creates a dmr_content object in the repository, which has a value of data_ticket equal to the value of DATA_TICKET returned at the end of END_PUSH_V2 call. As the result of this design, any authenticated user may create his own dmr_content object, pointing to already existing content in the Content Server filesystem. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101639 - https://www.exploit-db.com/exploits/43005/ - http://seclists.org/bugtraq/2017/
http://www.securityfocus.com/bid/101639 - https://www.exploit-db.com/exploits/43005/ - http://seclists.org/bugtraq/2017/Oct/19
CVE ID: CVE-2017-15015 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/724 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-15016 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/725
CVE ID: CVE-2017-15017 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/issues/723 - https://lists.debian.org/debian-lts-announce/2019/05/msg00015.html - https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
CVE ID: CVE-2017-15018 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: LAME 3.99.5, 3.99.4, 3.99.3, 3.99.2, 3.99.1, 3.99, 3.98.4, 3.98.2 and 3.98 have a heap-based buffer over-read when handling a malformed file in k_34_4 in vbrquantize.c. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/lame/bugs/480/
CVE ID: CVE-2017-15019 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c via a malformed mpg file, because of an incorrect calloc call. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/lame/bugs/477/
CVE ID: CVE-2017-15020 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: dwarf1.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, mishandles pointers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted ELF file, related to parse_die and parse_line_table, as demonstrated by a parse_die heap-based buffer over-read. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1da5c9a485f3dcac4c45e96ef4b7dae5
m Container: References: - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5 - https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-parse_die-dwarf1-c/ - https://sourceware.org/bugzilla/show_bug.cgi?id=22202
CVE ID: CVE-2017-15021 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: bfd_get_debug_link_info_1 in opncls.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted ELF file, related to bfd_getl32. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/10/03/binutils-heap-based-buffer-overflow-in-bfd_getl32-opncls-c/ - https://sourceware.org/bugzilla/show_bug.cgi?id=22197 - https://sourceware.org/
uffer-overflow-in-bfd_getl32-opncls-c/ - https://sourceware.org/bugzilla/show_bug.cgi?id=22197 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=52b36c51e5bf6d7600fdc6ba115b170b0e78e31d
CVE ID: CVE-2017-15022 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.387Z Vendors: n/a Products: n/a Problem Types: n/a Description: dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not validate the DW_AT_name data type, which allows remote attackers to cause a denial of service (bfd_hash_hash NULL pointer dereference, or out-of-bounds access, and application crash) via a crafted ELF file, related to scan_unit_for_symbols and parse_comp_unit. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=11855d8a1f11b102a702ab76e95b220
am Container: References: - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=11855d8a1f11b102a702ab76e95b22082cccf2f8 - https://sourceware.org/bugzilla/show_bug.cgi?id=22201 - https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-bfd_hash_hash-hash-c/
CVE ID: CVE-2017-15023 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: read_formatted_entries in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, does not properly validate the format count, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ELF file, related to concat_filename. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101611 - https://security.gentoo.org/glsa/201801-01 - https://sourceware.org/git/gitweb.cgi?p=binu
securityfocus.com/bid/101611 - https://security.gentoo.org/glsa/201801-01 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=c361faae8d964db951b7100cada4dcdc983df1bf - https://sourceware.org/bugzilla/show_bug.cgi?id=22200 - https://blogs.gentoo.org/ago/2017/10/03/binutils-null-pointer-dereference-in-concat_filename-dwarf2-c/
CVE ID: CVE-2017-15024 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: find_abstract_instance_name in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (infinite recursion and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.gentoo.org/ago/2017/10/03/binutils-infinite-loop-in-find_abstract_instance_name-dwarf2-c/ - https://sourceware.org/bugzilla/show_bug.cgi?id=22187 - https://sourceware.org/git/gitweb.cgi?p=binutils-
me-dwarf2-c/ - https://sourceware.org/bugzilla/show_bug.cgi?id=22187 - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=52a93b95ec0771c97e26f0bb28630a271a667bd2
CVE ID: CVE-2017-15025 State: PUBLISHED Published: 2017-10-04T07:00:00 Last Updated: 2024-08-05T19:42:22.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: decode_line_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted ELF file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/bugzilla/show_bug.cgi?id=22186 - https://blogs.gentoo.org/ago/2017/10/03/binutils-divide-by-zero-in-decode_line_info-dwarf2-c/ - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d8010d3
tils-divide-by-zero-in-decode_line_info-dwarf2-c/ - https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=d8010d3e75ec7194a4703774090b27486b742d48
CVE ID: CVE-2017-15029 State: PUBLISHED Published: 2019-05-23T15:00:32 Last Updated: 2024-08-05T19:42:22.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: SSRF. Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html
CVE ID: CVE-2017-15030 State: PUBLISHED Published: 2019-05-23T14:57:58 Last Updated: 2024-08-05T19:42:22.389Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS). Additional Analyst Notes: - CVE Program Container: References: - http://ox.com - http://open-xchange.com - https://documentation.open-xchange.com/7.8.3/release-notes/release-notes.html
CVE ID: CVE-2017-15031 State: PUBLISHED Published: 2018-12-18T16:00:00 Last Updated: 2024-08-05T19:42:22.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: In all versions of ARM Trusted Firmware up to and including v1.4, not initializing or saving/restoring the PMCR_EL0 register can leak secure world timing information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARM-software/arm-trusted-firmware/wiki/ARM-Trusted-Firmware-Security-Advisory-TFV-5 - http://www.securityfocus.com/bid/106271
CVE ID: CVE-2017-15032 State: PUBLISHED Published: 2017-10-05T07:00:00 Last Updated: 2024-08-05T19:42:22.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/commit/241988ca28139ad970c1d9717c419f41e360ddb0
CVE ID: CVE-2017-15033 State: PUBLISHED Published: 2017-10-05T07:00:00 Last Updated: 2024-08-05T19:42:22.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://github.com/ImageMagick/ImageMagick/commit/ef8f40689ac452398026c07da41656a7c87e4683
CVE ID: CVE-2017-15035 State: PUBLISHED Published: 2017-10-05T07:00:00 Last Updated: 2024-08-05T19:42:22.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: EmTec PyroBatchFTP before 3.18 allows remote servers to cause a denial of service (application crash). Additional Analyst Notes: - CVE Program Container: References: - https://www.emtec.com/downloads/pyrobatchftp/pyrobatchftp318_changes.txt - https://www.7elements.co.uk/resources/technical-advisories/pyrobatchftp-buffer-overflow-seh-overwrite/ - https://www.exploit-db.com/exploits/42962/
CVE ID: CVE-2017-15037 State: PUBLISHED Published: 2017-10-05T07:00:00 Last Updated: 2024-08-05T19:42:22.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: In FreeBSD through 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition with a resultant out-of-bounds read, because it can cause t2p->t_name strings to lack a final '\0' character. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101191 - https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=222687 - https://svnweb.freebsd.org/base?view=revision&revision=324102
CVE ID: CVE-2017-15038 State: PUBLISHED Published: 2017-10-09T14:00:00 Last Updated: 2024-08-05T19:42:22.384Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - https://www.debian.org/security/2018/dsa-4213 - https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg00729.html - https://usn.ubuntu.com/3575-1/ - http://www.openwall.c
s://lists.gnu.org/archive/html/qemu-devel/2017-10/msg00729.html - https://usn.ubuntu.com/3575-1/ - http://www.openwall.com/lists/oss-security/2017/10/06/1
CVE ID: CVE-2017-15039 State: PUBLISHED Published: 2017-11-06T08:00:00 Last Updated: 2024-08-05T19:42:22.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting. Additional Analyst Notes: - CVE Program Container: References: - https://bitbucket.org/zurmo/zurmo/issues/432/cross-site-scripting
CVE ID: CVE-2017-15041 State: PUBLISHED Published: 2017-10-05T21:00:00 Last Updated: 2024-08-05T19:42:22.368Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout ha
e tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get." Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3463 - https://access.redhat.com/errata/RHSA-2018:0878 - https://golang.org/cl/68190 - http://www.securityfocus.com/bid/101196 - https://golang.org/cl/68022 - https://security.gentoo.org/glsa/201710-23 - https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ - https://github.com/golang/go/issues/22125 - https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html
07AgAJ - https://github.com/golang/go/issues/22125 - https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html - https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
CVE ID: CVE-2017-15042 State: PUBLISHED Published: 2017-10-05T21:00:00 Last Updated: 2024-08-05T19:42:22.302Z Vendors: n/a Products: n/a Problem Types: n/a Description: An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does adver
eptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3463 - https://access.redhat.com/errata/RHSA-2018:0878 - http://www.securityfocus.com/bid/101197 - https://golang.org/cl/68210 - https://golang.org/cl/68023 - https://github.com/golang/go/issues/22134 - https://security.gentoo.org/glsa/201710-23 - https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ