Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t is in use, and or determine if an internal service exists via an argument injection vulnerability in the at parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103038 - https://jira.atlassian.com/browse/BSERV-10593
CVE ID: CVE-2017-18088 State: PUBLISHED Published: 2018-02-15T13:00:00 Last Updated: 2024-08-05T21:13:47.461Z Vendors: n/a Products: n/a Problem Types: n/a Description: Various plugin servlet resources in Atlassian Bitbucket Server before version 5.3.7 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.6 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.6 (the fixed version for 5.5.x), from version 5.6.0 before 5.6.3 (the fixed version for 5.6.x), from version 5.7.0 before 5.7.1 (the fixed version for 5.7.x) and before 5.8.0 allow remote attackers to conduct clickjacking attacks via framing various resources that lacked clickjacking protection. Additional Analyst Notes:
nduct clickjacking attacks via framing various resources that lacked clickjacking protection. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103040 - https://jira.atlassian.com/browse/BSERV-10594
CVE ID: CVE-2017-18089 State: PUBLISHED Published: 2018-02-16T18:00:00Z Last Updated: 2024-09-16T16:59:05.739Z Vendors: Atlassian Products: Crucible Problem Types: Cross Site Scripting (XSS) Description: The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the invited reviewers for a review. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103075 - https://jira.atlassian.com/browse/CRUC-8169
CVE ID: CVE-2017-18090 State: PUBLISHED Published: 2018-02-16T18:00:00Z Last Updated: 2024-09-17T01:40:40.678Z Vendors: Atlassian Products: Fisheye Problem Types: Cross Site Scripting (XSS) Description: Various resources in Atlassian Fisheye before version 4.5.1 (the fixed version for 4.5.x) and before version 4.6.0 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a commit author. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7000 - http://www.securityfocus.com/bid/103076
CVE ID: CVE-2017-18091 State: PUBLISHED Published: 2018-02-16T18:00:00Z Last Updated: 2024-09-16T20:22:54.697Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7006 - https://jira.atlassian.com/browse/CRUC-8173 - http://www.securityfocus.
s: - https://jira.atlassian.com/browse/FE-7006 - https://jira.atlassian.com/browse/CRUC-8173 - http://www.securityfocus.com/bid/103079
CVE ID: CVE-2017-18092 State: PUBLISHED Published: 2018-02-19T14:00:00Z Last Updated: 2024-09-17T04:09:13.299Z Vendors: Atlassian Products: Crucible Problem Types: Cross Site Scripting (XSS) Description: The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of a comment on the snippet. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CRUC-8176 - http://www.securityfocus.com/bid/103082
CVE ID: CVE-2017-18093 State: PUBLISHED Published: 2018-02-19T14:00:00Z Last Updated: 2024-09-17T02:11:00.999Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103095 - https://jira.atlassian.com/browse/CRUC-81
CVE Program Container: References: - http://www.securityfocus.com/bid/103095 - https://jira.atlassian.com/browse/CRUC-8175 - https://jira.atlassian.com/browse/FE-7008
CVE ID: CVE-2017-18094 State: PUBLISHED Published: 2018-03-22T13:00:00Z Last Updated: 2024-09-16T18:28:38.668Z Vendors: Atlassian Products: Fisheye and Crucible Problem Types: Cross Site Scripting (XSS) Description: Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7010 - https://jira.atlassian.com/browse/CRUC-8177
CVE ID: CVE-2017-18095 State: PUBLISHED Published: 2018-02-19T14:00:00Z Last Updated: 2024-09-16T17:28:59.763Z Vendors: Atlassian Products: Crucible Problem Types: CWE-863 Description: The SnippetRPCServiceImpl class in Atlassian Crucible before version 4.5.1 (the fixed version 4.5.x) and before 4.6.0 allows remote attackers to comment on snippets they do not have authorization to access via an improper authorization vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103207 - https://jira.atlassian.com/browse/CRUC-8178
CVE ID: CVE-2017-18096 State: PUBLISHED Published: 2018-04-04T12:00:00Z Last Updated: 2024-09-16T17:54:30.699Z Vendors: Atlassian Products: Atlassian Application Links Problem Types: Server-Side Request Forgery (SSRF) Description: The OAuth status rest resource in Atlassian Application Links before version 5.2.7, from 5.3.0 before 5.3.4 and from 5.4.0 before 5.4.3 allows remote attackers with administrative rights to access the content of internal network resources via a Server Side Request Forgery (SSRF) by creating an OAuth application link to a location they control and then redirecting access from the linked location's OAuth status rest resource to an internal location. When running in a
then redirecting access from the linked location's OAuth status rest resource to an internal location. When running in an environment like Amazon EC2, this flaw maybe used to access to a metadata resource that provides access credentials and other potentially confidential information. Additional Analyst Notes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/APL-1359
CVE ID: CVE-2017-18097 State: PUBLISHED Published: 2018-04-06T13:00:00Z Last Updated: 2024-09-16T22:14:42.823Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello card. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103764 - https://jira.atlassian.com/browse/JRASERVER-67076
CVE ID: CVE-2017-18098 State: PUBLISHED Published: 2018-04-06T13:00:00Z Last Updated: 2024-09-16T18:38:34.469Z Vendors: Atlassian Products: Jira Problem Types: Cross Site Scripting (XSS) Description: The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through various fields. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-67075 - http://www.securityfocus.com/bid/103765
CVE ID: CVE-2017-18100 State: PUBLISHED Published: 2018-04-10T13:00:00 Last Updated: 2024-08-05T21:13:48.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-67106 - http://www.securityfocus.com/bid/103729
CVE ID: CVE-2017-18101 State: PUBLISHED Published: 2018-04-10T13:00:00Z Last Updated: 2024-09-16T17:19:13.139Z Vendors: Atlassian Products: Jira Problem Types: CWE-284 Description: Various administrative external system import resources in Atlassian JIRA Server (including JIRA Core) before version 7.6.5, from version 7.7.0 before version 7.7.3, from version 7.8.0 before version 7.8.3 and before version 7.9.0 allow remote attackers to run import operations and to determine if an internal service exists through missing permission checks. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103730 - https://jira.atlassian.com/browse/JRASERVER-67107
CVE ID: CVE-2017-18102 State: PUBLISHED Published: 2018-04-17T13:00:00Z Last Updated: 2024-09-17T02:22:00.546Z Vendors: Atlassian Products: atlassian-renderer Problem Types: Cross Site Scripting (XSS) Description: The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in nested wiki markup. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-67108 - https://jira.atlassian.com/browse/RNDR-153
CVE ID: CVE-2017-18103 State: PUBLISHED Published: 2018-07-18T14:00:00Z Last Updated: 2024-09-17T01:55:44.514Z Vendors: Atlassian Products: atlassian-http Problem Types: Content Spoofing Description: The atlassian-http library, as used in various Atlassian products, before version 2.0.2 allows remote attackers to spoof web content in the Mozilla Firefox Browser through uploaded files that have a content-type of application/mathml+xml. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/HTTP-3
CVE ID: CVE-2017-18104 State: PUBLISHED Published: 2018-07-24T13:00:00Z Last Updated: 2024-09-16T19:46:59.715Z Vendors: Atlassian Products: Jira Problem Types: Information Exposure Description: The Webhooks component of Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.11.0 allows remote attackers who are able to observe or otherwise intercept webhook events to learn information about changes in issues that should not be sent because they are not contained within the results of a specified JQL query. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/JRASERVER-59980
CVE ID: CVE-2017-18105 State: PUBLISHED Published: 2019-03-29T14:04:53.127166Z Last Updated: 2024-09-16T20:42:15.439Z Vendors: Atlassian Products: Crowd Problem Types: Session Fixation Description: The console login resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers, who have previously obtained a user's JSESSIONID cookie, to gain access to some of the built-in and potentially third party rest resources via a session fixation vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5072
CVE ID: CVE-2017-18106 State: PUBLISHED Published: 2019-03-29T14:04:53.177984Z Last Updated: 2024-09-16T23:40:45.456Z Vendors: Atlassian Products: Crowd Problem Types: Use of a Broken or Risky Cryptographic Algorithm Description: The identifier_hash for a session token in Atlassian Crowd before version 2.9.1 could potentially collide with an identifier_hash for another user or a user in a different directory, this allows remote attackers who can authenticate to Crowd or an application using Crowd for authentication to gain access to another user's session provided they can make their identifier hash collide with another user's session identifier hash. Additional Analyst Notes: - CVE Program
make their identifier hash collide with another user's session identifier hash. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5061
CVE ID: CVE-2017-18107 State: PUBLISHED Published: 2019-12-17T03:45:13.620288Z Last Updated: 2024-09-16T20:06:27.427Z Vendors: Atlassian Products: Crowd Problem Types: Cross-Site Request Forgery (CSRF) Description: Various resources in the Crowd Demo application of Atlassian Crowd before version 3.1.1 allow remote attackers to modify add, modify and delete users & groups via a Cross-site request forgery (CSRF) vulnerability. Please be aware that the Demo application is not enabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5091
CVE ID: CVE-2017-18108 State: PUBLISHED Published: 2019-03-29T14:04:53.218686Z Last Updated: 2024-09-16T22:30:08.235Z Vendors: Atlassian Products: Crowd Problem Types: n/a Description: The administration SMTP configuration resource in Atlassian Crowd before version 2.10.2 allows remote attackers with administration rights to execute arbitrary code via a JNDI injection. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5062
CVE ID: CVE-2017-18109 State: PUBLISHED Published: 2019-03-29T14:04:53.255719Z Last Updated: 2024-09-16T17:08:13.135Z Vendors: Atlassian Products: Crowd Problem Types: URL Redirection to Untrusted Site ('Open Redirect') Description: The login resource of CrowdId in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5071
CVE ID: CVE-2017-18110 State: PUBLISHED Published: 2019-03-29T14:04:53.296517Z Last Updated: 2024-09-16T18:08:23.904Z Vendors: Atlassian Products: Crowd Problem Types: Improper Restriction of XML External Entity Reference ('XXE') Description: The administration backup restore resource in Atlassian Crowd before version 3.0.2 and from version 3.1.0 before version 3.1.1 allows remote attackers to read files from the filesystem via a XXE vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/CWD-5070
CVE ID: CVE-2017-18111 State: PUBLISHED Published: 2019-03-29T14:04:53.340099Z Last Updated: 2024-09-16T17:32:37.560Z Vendors: Atlassian Products: Application Links Problem Types: Improper Restriction of XML External Entity Reference ('XXE') Description: The OAuthHelper in Atlassian Application Links before version 5.0.10, from version 5.1.0 before version 5.1.3, and from version 5.2.0 before version 5.2.6 used an XML document builder that was vulnerable to XXE when consuming a client OAuth request. This allowed malicious oauth application linked applications to probe internal network resources by requesting internal locations, read the contents of files and also cause an out of memory excep
nal network resources by requesting internal locations, read the contents of files and also cause an out of memory exception affecting availability via an XML External Entity vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://ecosystem.atlassian.net/browse/APL-1338
CVE ID: CVE-2017-18112 State: PUBLISHED Published: 2020-08-05T03:25:13.445444Z Last Updated: 2024-09-16T22:15:39.524Z Vendors: Atlassian Products: Fisheye Problem Types: Information Disclosure Description: Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3. Additional Analyst Notes: - CVE Program Container: References: - https://jira.atlassian.com/browse/FE-7309
CVE ID: CVE-2017-18113 State: PUBLISHED Published: 2021-08-02T02:35:10.548806Z Last Updated: 2024-10-17T16:03:55.792Z Vendors: Atlassian Products: Jira Server, Jira Data Center Problem Types: CWE-94 Description: The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution (RCE) vulnerability. The vulnerability allowed for various problematic OSWorkflow classes to be used as part of workflows. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into
s. The fix for this issue blocks usage of unsafe conditions, validators, functions and registers that are build-in into OSWorkflow library and other Jira dependencies. Atlassian-made functions or functions provided by 3rd party plugins are not affected by this fix. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://jira.atlassian.com/browse/JRASERVER-72660
CVE ID: CVE-2017-18120 State: PUBLISHED Published: 2018-02-02T09:00:00 Last Updated: 2024-08-05T21:13:48.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because last_name is mishandled, a different vulnerability than CVE-2017-1000421. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878739 - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881120 - https://github.com/kohler/gifsicle/issues/117 - https://github.com/kohle
s.debian.org/cgi-bin/bugreport.cgi?bug=881120 - https://github.com/kohler/gifsicle/issues/117 - https://github.com/kohler/gifsicle/commit/118a46090c50829dc543179019e6140e1235f909
CVE ID: CVE-2017-18121 State: PUBLISHED Published: 2018-02-02T15:00:00 Last Updated: 2024-08-05T21:13:48.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser. Additional Analyst Notes: - CVE Program Container: References: - https://simplesamlphp.org/security/201709-01 - https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html - https://www.debian.org/security/2018/dsa-4127
CVE ID: CVE-2017-18122 State: PUBLISHED Published: 2018-02-02T15:00:00 Last Updated: 2024-08-05T21:13:48.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP. Ad
will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html - https://www.debian.org/security/2018/dsa-4127 - https://simplesamlphp.org/security/201710-01
CVE ID: CVE-2017-18123 State: PUBLISHED Published: 2018-02-03T03:00:00 Last Updated: 2024-08-05T21:13:48.188Z Vendors: n/a Products: n/a Problem Types: n/a Description: The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/splitbrain/dokuwiki/pull/2019 - https://vulnhive.com/2018/000004 - https://lists.debian.org/debian-lts-announce/2018/02/msg00004.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00004.html - https://github.com/spl
unce/2018/02/msg00004.html - https://lists.debian.org/debian-lts-announce/2018/07/msg00004.html - https://github.com/splitbrain/dokuwiki/commit/238b8e878ad48f370903465192b57c2072f65d86 - https://hackerone.com/reports/238316 - https://github.com/splitbrain/dokuwiki/issues/2029
CVE ID: CVE-2017-18124 State: PUBLISHED Published: 2018-10-26T13:00:00 Last Updated: 2024-08-05T21:13:48.201Z Vendors: Qualcomm, Inc. Products: Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear Problem Types: Use of Out-of-range Pointer Offset in Core Description: During secure boot, addition is performed on uint8 ptrs which led to overflow issue in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, S
SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDX20 Additional Analyst Notes: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins
CVE ID: CVE-2017-18125 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-16T20:12:18.855Z Vendors: Qualcomm, Inc. Products: Snapdragon Mobile, Snapdragon Wear Problem Types: Improper Input Validation in TrustZone Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD 845, SD 850, when secure camera is activated it stores captured data in protected buffers. The TEE application which uses secure camera expects those buffers to contain data captured during the current camera session. It is possible though for HLOS to put aside and reuse one or more of the pr
captured during the current camera session. It is possible though for HLOS to put aside and reuse one or more of the protected buffers with previously captured data during next camera session. Such data reuse must be prevented as the TEE applications expects to receive valid data captured during the current session only. Additional Analyst Notes: - CVE Program Container: References: - https://source.android.com/security/bulletin/2018-04-01 - http://www.securityfocus.com/bid/103671
CVE ID: CVE-2017-18126 State: PUBLISHED Published: 2018-04-11T15:00:00Z Last Updated: 2024-09-16T23:16:11.193Z Vendors: Qualcomm, Inc. Products: Snapdragon Mobile, Snapdragon Wear Problem Types: Use of Insufficiently Random Values in WLAN. Description: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the original mac spoofing feature does not