Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ering the bug does not grant any powers not already held.” Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa9f7d5172fac9bf1f09e678c35e287a40a7b7dd - https://www.debian.org/security/2020/dsa-4667 - https://usn.ubuntu.com/4364-1/ - https://usn.ubuntu.com/4367-1/ - https://usn.ubuntu.com/4368-1/ - https://usn.ubuntu.com/4363-1/ - https://usn.ubuntu.com/4369-1/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
bian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698
CVE ID: CVE-2020-11576 State: PUBLISHED Published: 2020-04-08T17:40:50 Last Updated: 2024-08-04T11:35:13.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fixed in v1.5.1, Argo version v1.5.0 was vulnerable to a user-enumeration vulnerability which allowed attackers to determine the usernames of valid (non-SSO) accounts because /api/v1/session returned 401 for an existing username and 404 otherwise. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/argoproj/argo-cd/pull/3215 - https://github.com/argoproj/argo-cd/commit/35a7350b7444bcaf53ee0bb11b9d8e3ae4b717a1 - https://www.soluble.ai/blog/argo-cves-2020
CVE ID: CVE-2020-11579 State: PUBLISHED Published: 2020-09-03T17:15:08 Last Updated: 2024-08-04T11:35:13.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://shielder.it/ - https://github.com/ShielderSec/CVE-2020-11579 - https://www.shielder.it/blog/mysql-and-cve-2020-11579-exploitation/ - https://www.phpkb.com
CVE ID: CVE-2020-11580 State: PUBLISHED Published: 2020-04-06T20:03:00 Last Updated: 2024-08-04T11:35:13.171Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, accepts an arbitrary SSL certificate. Additional Analyst Notes: - CVE Program Container: References: - https://git.lsd.cat/g/pulse-host-checker-rce - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426
CVE ID: CVE-2020-11581 State: PUBLISHED Published: 2020-04-06T20:03:38 Last Updated: 2024-08-04T11:35:13.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, allows a man-in-the-middle attacker to perform OS command injection attacks (against a client) via shell metacharacters to the doCustomRemediateInstructions method, because Runtime.getRuntime().exec() is used. Additional Analyst Notes: - CVE Program Container: References: - https://git.lsd.cat/g/pulse-host-checker-rce - https://kb.p
tional Analyst Notes: - CVE Program Container: References: - https://git.lsd.cat/g/pulse-host-checker-rce - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426
CVE ID: CVE-2020-11582 State: PUBLISHED Published: 2020-04-06T20:03:20 Last Updated: 2024-08-04T11:35:13.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Pulse Secure Pulse Connect Secure (PCS) through 2020-04-06. The applet in tncc.jar, executed on macOS, Linux, and Solaris clients when a Host Checker policy is enforced, launches a TCP server that accepts local connections on a random port. This can be reached by local HTTP clients, because up to 25 invalid lines are ignored, and because DNS rebinding can occur. (This server accepts, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.) Additional Analyst Notes: -
s, for example, a setcookie command that might be relevant to CVE-2020-11581 exploitation.) Additional Analyst Notes: - CVE Program Container: References: - https://git.lsd.cat/g/pulse-host-checker-rce - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44426
CVE ID: CVE-2020-11583 State: PUBLISHED Published: 2020-08-03T20:12:17 Last Updated: 2024-08-04T11:35:13.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5
CVE ID: CVE-2020-11584 State: PUBLISHED Published: 2020-08-03T20:05:46 Last Updated: 2024-08-04T11:35:13.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%400x00crash/xss-reflected-in-plesk-onyx-and-obsidian-1173a3eaffb5
CVE ID: CVE-2020-11585 State: PUBLISHED Published: 2020-04-06T20:27:46 Last Updated: 2024-08-04T11:35:13.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an information disclosure issue in DNN (formerly DotNetNuke) 9.5 within the built-in Activity-Feed/Messaging/Userid/ Message Center module. A registered user is able to enumerate any file in the Admin File Manager (other than ones contained in a secure folder) by sending themselves a message with the file attached, e.g., by using an arbitrary small integer value in the fileIds parameter. Additional Analyst Notes: - CVE Program Container: References: - https://neff.blog/2020/04/04/dotnetnuke-9-5-file-path-information-
Analyst Notes: - CVE Program Container: References: - https://neff.blog/2020/04/04/dotnetnuke-9-5-file-path-information-disclosure/
CVE ID: CVE-2020-11586 State: PUBLISHED Published: 2020-04-06T21:35:16 Last Updated: 2024-08-04T11:35:13.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11587 State: PUBLISHED Published: 2020-04-06T21:34:59 Last Updated: 2024-08-04T11:35:13.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the content of ETL Processes running on the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11588 State: PUBLISHED Published: 2020-04-06T21:34:51 Last Updated: 2024-08-04T11:35:13.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to two files that contain customer data and application paths. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11589 State: PUBLISHED Published: 2020-04-06T21:34:34 Last Updated: 2024-08-04T11:35:13.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11590 State: PUBLISHED Published: 2020-04-06T21:34:22 Last Updated: 2024-08-04T11:35:13.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11591 State: PUBLISHED Published: 2020-04-06T21:34:12 Last Updated: 2024-08-04T11:35:13.524Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11592 State: PUBLISHED Published: 2020-04-06T21:34:00 Last Updated: 2024-08-04T11:35:13.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the columns of a specific table within the CIP database. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11593 State: PUBLISHED Published: 2020-04-06T21:33:49 Last Updated: 2024-08-04T11:35:13.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11594 State: PUBLISHED Published: 2020-04-06T21:33:32 Last Updated: 2024-08-04T11:35:13.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that causes a stack error to be shown providing the full file path. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11595 State: PUBLISHED Published: 2020-04-06T21:33:20 Last Updated: 2024-08-04T11:35:13.587Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the upload folder path that includes the hostname in a UNC path. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11596 State: PUBLISHED Published: 2020-04-06T21:33:03 Last Updated: 2024-08-04T11:35:13.530Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make HTTP GET requests to a certain URL and obtain information about what files and directories reside on the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11597 State: PUBLISHED Published: 2020-04-06T21:32:15 Last Updated: 2024-08-04T11:35:13.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request and inject SQL statements in the user context of the db owner. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11598 State: PUBLISHED Published: 2020-04-06T21:31:55 Last Updated: 2024-08-04T11:35:13.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11599 State: PUBLISHED Published: 2020-04-06T21:31:39 Last Updated: 2024-08-04T11:35:13.314Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in CIPPlanner CIPAce 6.80 Build 2016031401. GetDistributedPOP3 allows attackers to obtain the username and password of the SMTP user. Additional Analyst Notes: - CVE Program Container: References: - https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform/
CVE ID: CVE-2020-11600 State: PUBLISHED Published: 2020-04-08T15:11:17 Last Updated: 2024-08-04T11:35:13.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. There is arbitrary code execution in the Fingerprint Trustlet via a memory overwrite. The Samsung IDs are SVE-2019-16587, SVE-2019-16588, SVE-2019-16589 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - http://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-11601 State: PUBLISHED Published: 2020-04-08T15:14:32 Last Updated: 2024-08-04T11:35:13.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. There is unauthorized access to applications in the Secure Folder via floating icons. The Samsung ID is SVE-2019-16195 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-11602 State: PUBLISHED Published: 2020-04-08T15:19:33 Last Updated: 2024-08-04T11:35:13.231Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Google Assistant leaks clipboard contents on a locked device. The Samsung ID is SVE-2019-16558 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-11603 State: PUBLISHED Published: 2020-04-08T15:41:55 Last Updated: 2024-08-04T11:35:13.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. Type confusion in the MLDAP Trustlet allows arbitrary code execution. The Samsung ID is SVE-2020-16599 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://www.tuttoandroid.net/samsung/samsung-patch-sicurezza-aprile-2020-798658/
CVE ID: CVE-2020-11604 State: PUBLISHED Published: 2020-04-08T15:27:55 Last Updated: 2024-08-04T11:35:13.337Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. There is an Out-of-bounds read in the MLDAP Trustlet. The Samsung ID is SVE-2019-16565 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-11605 State: PUBLISHED Published: 2020-04-08T15:30:04 Last Updated: 2024-08-04T11:35:13.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is sensitive information exposure from dumpstate in NFC logs. The Samsung ID is SVE-2019-16359 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-11606 State: PUBLISHED Published: 2020-04-08T15:34:11 Last Updated: 2024-08-04T11:35:13.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with Q(10.0) software. Information about application preview (in the Secure Folder) leaks on a locked device. The Samsung ID is SVE-2019-16463 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-11607 State: PUBLISHED Published: 2020-04-08T15:35:41 Last Updated: 2024-08-04T11:35:13.377Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) software. Notification exposure occurs in Lockdown mode because of the Edge Lighting application. The Samsung ID is SVE-2020-16680 (April 2020). Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb
CVE ID: CVE-2020-11608 State: PUBLISHED Published: 2020-04-07T13:55:08 Last Updated: 2024-08-04T11:35:13.670Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Linux kernel before 5.6.1. drivers/media/usb/gspca/ov519.c allows NULL pointer dereferences in ov511_mode_init_regs and ov518_mode_init_regs when there are zero endpoints, aka CID-998912346c0d. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/998912346c0da53a6dbb71fab3a138586b596b30 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=998912346c0da53a6dbb71fab3a138586b596b30 - https://cdn.kernel.org/pub/linux/kernel
nel/git/torvalds/linux.git/commit/?id=998912346c0da53a6dbb71fab3a138586b596b30 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1 - https://security.netapp.com/advisory/ntap-20200430-0004/ - https://usn.ubuntu.com/4345-1/ - https://usn.ubuntu.com/4364-1/ - https://usn.ubuntu.com/4368-1/ - https://usn.ubuntu.com/4369-1/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
CVE ID: CVE-2020-11609 State: PUBLISHED Published: 2020-04-07T16:05:56 Last Updated: 2024-08-04T11:35:13.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the stv06xx subsystem in the Linux kernel before 5.6.1. drivers/media/usb/gspca/stv06xx/stv06xx.c and drivers/media/usb/gspca/stv06xx/stv06xx_pb0100.c mishandle invalid descriptors, as demonstrated by a NULL pointer dereference, aka CID-485b06aadb93. Additional Analyst Notes: - CVE Program Container: References: - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.1 - https://github.com/torvalds/linux/commit/485b06aadb933190f4bc44e006076bc27a23f205 - https://git.kernel.org/cgit/linux/kernel/
://github.com/torvalds/linux/commit/485b06aadb933190f4bc44e006076bc27a23f205 - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=485b06aadb933190f4bc44e006076bc27a23f205 - https://security.netapp.com/advisory/ntap-20200430-0004/ - https://usn.ubuntu.com/4345-1/ - https://usn.ubuntu.com/4364-1/ - https://usn.ubuntu.com/4368-1/ - https://usn.ubuntu.com/4369-1/ - https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html - https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html - https://www.debian.org/security/2020/dsa-4698 - http://lists.opensuse.org/opensuse-security-announce/2020
sg00013.html - https://www.debian.org/security/2020/dsa-4698 - http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00022.html
CVE ID: CVE-2020-11610 State: PUBLISHED Published: 2020-04-07T17:19:06 Last Updated: 2024-08-04T11:35:13.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ofirdagan/cross-domain-local-storage - https://grimhacker.com/exploiting-xdlocalstorage-l
ferences: - https://github.com/ofirdagan/cross-domain-local-storage - https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Magic-iframe
CVE ID: CVE-2020-11611 State: PUBLISHED Published: 2020-04-07T17:18:54 Last Updated: 2024-08-04T11:35:13.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ofirdagan/cross-domain-local-storage - https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Mi
ofirdagan/cross-domain-local-storage - https://grimhacker.com/exploiting-xdlocalstorage-localstorage-and-postmessage/#Missing-TargetOrigin-Client
CVE ID: CVE-2020-11612 State: PUBLISHED Published: 2020-04-07T18:00:34 Last Updated: 2024-08-04T11:35:13.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r2958e4d49ee046e1e561e44fdc114a0d2285927501880f15852a9b53%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r3195127e46c87a680b5d1
d2285927501880f15852a9b53%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r3195127e46c87a680b5d1d3733470f83b886bfd3b890c50df718bed1%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r14446ed58208cb6d97b6faa6ebf145f1cf2c70c0886c0c133f4d3b6f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/ra98e3a8541a09271f96478d5e22c7e3bd1afdf48641c8be25d62d9f9%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r8a654f11e1172b0effbfd6f8d5b6ca651ae4ac724a976923c268a42f%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r7836bbdbe95c99d4d725199f0c169927d4e87ba57e4beeeb699c097a%40%3Ccommits.druid.apach