Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-6796 State: PUBLISHED Published: 2017-08-11T02:00:00Z Last Updated: 2024-09-17T03:32:53.822Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Sandbox escape Description: A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1548 - https://lists.apache.org/thread.html/5a2105a56b2495ab70fa568f06925bd861f0d71ffab4fb38bb4fdc45%40%3Cannounc
A-2017:1548 - https://lists.apache.org/thread.html/5a2105a56b2495ab70fa568f06925bd861f0d71ffab4fb38bb4fdc45%40%3Cannounce.tomcat.apache.org%3E - https://access.redhat.com/errata/RHSA-2017:1549 - http://www.securityfocus.com/bid/93944 - https://access.redhat.com/errata/RHSA-2017:1552 - http://www.securitytracker.com/id/1038757 - http://www.securitytracker.com/id/1037141 - https://access.redhat.com/errata/RHSA-2017:2247 - http://rhn.redhat.com/errata/RHSA-2017-1551.html - http://rhn.redhat.com/errata/RHSA-2017-0457.html - https://access.redhat.com/errata/RHSA-2017:0455 - https://access.redhat.com/errata/RHSA-2017:1550 - http://www.debian.org/security/2016/dsa-3720 - https://access.redhat.com/e
s://access.redhat.com/errata/RHSA-2017:1550 - http://www.debian.org/security/2016/dsa-3720 - https://access.redhat.com/errata/RHSA-2017:0456 - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/39ae1f0bd5867c15
6594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - htt
ists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6
a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E - https://usn.ubuntu.com/4557-1/ - https://security.netapp.com/advisory/ntap-20180605-0001/ - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2016-6797 State: PUBLISHED Published: 2017-08-10T22:00:00Z Last Updated: 2024-09-17T04:24:37.373Z Vendors: Apache Software Foundation Products: Apache Tomcat Problem Types: Information Disclosure Description: The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. Additional Analyst Notes: - CVE Program Container: Reference
hether an explicit ResourceLink had been configured or not. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/93940 - https://lists.apache.org/thread.html/9325837eb00cba5752c092047433c7f0415134d16e7f391447ff4352%40%3Cannounce.tomcat.apache.org%3E - http://www.securitytracker.com/id/1037145 - https://access.redhat.com/errata/RHSA-2017:2247 - http://rhn.redhat.com/errata/RHSA-2017-0457.html - https://access.redhat.com/errata/RHSA-2017:0455 - http://www.debian.org/security/2016/dsa-3720 - https://access.redhat.com/errata/RHSA-2017:0456 - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.a
7:0456 - https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11255f8e219e81d45c4f8d0551%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbcb20338e3c7eb131457f708%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63dcd6a90429e16ea9f83bbedc%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75
de1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570ccf0b17ffa77493745af9a17a%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c79fc993d85f34c1f5c77424%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf1819f04f988315086931d7%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://lis
che.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb338ba141d3b77b8c7cb61b3%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E - https://usn.ubuntu.com/4557-1/ - https://security.netapp.com/advisory/ntap-20180605-
a9b%40%3Cdev.tomcat.apache.org%3E - https://usn.ubuntu.com/4557-1/ - https://security.netapp.com/advisory/ntap-20180605-0001/ - https://www.oracle.com/security-alerts/cpuoct2021.html
CVE ID: CVE-2016-6798 State: PUBLISHED Published: 2017-07-19T15:00:00Z Last Updated: 2024-09-16T16:47:49.975Z Vendors: Apache Software Foundation Products: Apache Sling Problem Types: n/a Description: In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apac
the firewall or DoS the application. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/b72c3a511592ec70729b3ec2d29302b6ce87bbeab62d4745617a6bd0%40%3Cdev.sling.apache.org%3E - http://www.securityfocus.com/bid/99873
CVE ID: CVE-2016-6799 State: PUBLISHED Published: 2017-05-09T15:00:00 Last Updated: 2024-08-06T01:43:37.895Z Vendors: Apache Software Foundation Products: Apache Cordova Android Problem Types: Information Disclosure Description: Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition to the current log. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed
e read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/98365 - https://lists.apache.org/thread.html/1f3e7b0319d64b455f73616f572acee36fbca31f87f5b2e509c45b69%40%3Cdev.cordova.apache.org%3E
CVE ID: CVE-2016-6800 State: PUBLISHED Published: 2017-08-30T17:00:00Z Last Updated: 2024-09-16T16:34:06.607Z Vendors: Apache Software Foundation Products: Apache OFBiz Problem Types: Information Disclosure Description: The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaScript code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigati
code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigation: Upgrade to Apache OFBiz 16.11.01. Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/Owsz - https://lists.apache.org/thread.html/28987cffe0237fa67eca9de8bbbc04a917ac8785342ad9e5a196c978%40%3Cuser.ofbiz.apache.org%3E
CVE ID: CVE-2016-6801 State: PUBLISHED Published: 2016-09-21T14:00:00 Last Updated: 2024-08-06T01:43:37.897Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/l
crafted Content-Type header. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2016/09/14/6 - http://www.debian.org/security/2016/dsa-3679 - https://issues.apache.org/jira/browse/JCR-4009 - http://www.securityfocus.com/bid/92966
CVE ID: CVE-2016-6802 State: PUBLISHED Published: 2016-09-20T19:00:00 Last Updated: 2024-08-06T01:43:37.909Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/539397/100/0/threaded - http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.html - http://www.securityfocus.com/bid/92947
CVE ID: CVE-2016-6803 State: PUBLISHED Published: 2017-11-13T14:00:00Z Last Updated: 2024-09-16T17:54:04.633Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: Trojan Execution (on previously infected system) Description: An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Windows. The PC must have previously been infected by a Trojan Horse application (or user) running with administrative privilege. Any installer with the unquoted search path vulnerability becomes a delayed trigger for the exploit. Additional Analyst Notes: - CVE Program Container: References: - http://www.securi
es a delayed trigger for the exploit. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94418 - https://www.openoffice.org/security/cves/CVE-2016-6803.html - http://www.securitytracker.com/id/1037015
CVE ID: CVE-2016-6804 State: PUBLISHED Published: 2017-11-20T15:00:00Z Last Updated: 2024-09-16T17:32:53.280Z Vendors: Apache Software Foundation Products: Apache OpenOffice Problem Types: Arbitrary Code Execution at installation time Description: The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows execution of arbitrary code with elevated privileges. This requires that the location in which the installer is run has been previously poisoned by a file that impersonates a dynamic-link library that the installer depends upon. Additional Analyst Notes: - CVE Program Container: References: - htt
namic-link library that the installer depends upon. Additional Analyst Notes: - CVE Program Container: References: - https://www.openoffice.org/security/cves/CVE-2016-6804.html - http://www.securityfocus.com/bid/93774 - http://www.securitytracker.com/id/1037016
CVE ID: CVE-2016-6805 State: PUBLISHED Published: 2017-04-07T19:00:00 Last Updated: 2024-08-06T01:43:37.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97509 - http://seclists.org/oss-sec/2017/q2/31
CVE ID: CVE-2016-6806 State: PUBLISHED Published: 2017-10-02T13:00:00Z Last Updated: 2024-09-16T20:57:22.659Z Vendors: Apache Software Foundation Products: Apache Wicket Problem Types: CSRF check fails Description: Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin requests. The mitigation is to not only check the Origin HTTP header, but also take the Referer HTTP header into account when no Origin was provided. Furthermore, not all Wicket server side targets were subjected to the CSRF check. This was also fixed. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thr
heck. This was also fixed. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/074b72585f4b7c6adda1af52aecbfe1be23c6d6f5bb9382270f059cd%40%3Cannounce.apache.org%3E
CVE ID: CVE-2016-6807 State: PUBLISHED Published: 2017-03-28T20:00:00 Last Updated: 2024-08-06T01:43:37.895Z Vendors: Apache Software Foundation Products: Apache Ambari Problem Types: missing authorization check Description: Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97184 - https://cwiki.apache.org/confluence/display/AMBARI/Ambari+V
iner: References: - http://www.securityfocus.com/bid/97184 - https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities#AmbariVulnerabilities-FixedinAmbari2.4.2
CVE ID: CVE-2016-6808 State: PUBLISHED Published: 2017-04-12T20:00:00 Last Updated: 2024-08-06T01:43:37.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1036969 - http://seclists.org/fulldisclosure/2016/Oct/44 - https://access.redhat.com/errata/RHSA-2017:0194 - http://www.securityfocus.com/bid/93429 - https://access.redhat.com/errata/RHSA-2017:0193 - http://rhn.redhat.com/errata/RHSA-2016-2957.html - http://tomcat.apache.org/security-jk.html - http://packetstormsecurity.com/files/139071/Apache-Tomcat-JK-ISAPI-Con
tml - http://tomcat.apache.org/security-jk.html - http://packetstormsecurity.com/files/139071/Apache-Tomcat-JK-ISAPI-Connector-1.2.41-Buffer-Overflow.html - http://www.openwall.com/lists/oss-security/2016/10/06/4 - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomc
che.org%3E - https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2016-6809 State: PUBLISHED Published: 2017-04-06T21:00:00 Last Updated: 2024-08-06T01:43:37.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/94247 - https://dist.apache.org/repos/dist/release/tika/CHANGES-1.14.txt - http://seclists.org/bugtraq/2016/Nov/40 - https://lists.apache.org/thread.html/e414754a6c57ce7194b731e211cd6b2cbb41f2c7000e3fb9c6b6ec78%40%3Cdev.lucene.apache.org%3E - https://lists.ap
rg/thread.html/e414754a6c57ce7194b731e211cd6b2cbb41f2c7000e3fb9c6b6ec78%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thread.html/91eb639ef619b9a26b40020ca6732e7dbe457f7322ed5f1df49e411a%40%3Cdev.nutch.apache.org%3E - https://lists.apache.org/thread.html/d2375da29d89e679abf5d845db76d6f798fdc6f7d44f2c788e8a0fb9%40%3Cuser.nutch.apache.org%3E - https://lists.apache.org/thread.html/r2f6f6c130b12b7332f323f74d031072b1517065ce28a22346791ffb6%40%3Cissues.lucene.apache.org%3E - https://lists.apache.org/thread.html/rfd3646bb724b66b1a9ddef69e692da2b7a727a8799551c78eedf0a0f%40%3Cissues.lucene.apache.org%3E
CVE ID: CVE-2016-6810 State: PUBLISHED Published: 2018-01-10T15:00:00Z Last Updated: 2024-09-16T22:41:37.290Z Vendors: Apache Software Foundation Products: Apache ActiveMQ Problem Types: Cross-Site Scripting Description: In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation. Additional Analyst Notes: - CVE Program Container: References: - http://activemq.apache.org/security-advisories.data/CVE-2016-6810-announcement.txt - http://www.securitytracker.com/id/1037475 - http://www.securityfocus.com/bid/94882 - https://lists.
0-announcement.txt - http://www.securitytracker.com/id/1037475 - http://www.securityfocus.com/bid/94882 - https://lists.apache.org/thread.html/924a3a27fad192d711436421e02977ff90d9fc0f298e1efe6757cfbc%40%3Cusers.activemq.apache.org%3E - https://lists.apache.org/thread.html/a859563f05fbe7c31916b3178c2697165bd9bbf5a65d1cf62aef27d2%40%3Ccommits.activemq.apache.org%3E
CVE ID: CVE-2016-6811 State: PUBLISHED Published: 2017-04-11T14:00:00Z Last Updated: 2024-09-16T23:25:57.230Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/9ba3c12bbdfd5b2cae60909e48f92608e00c8d99196390b8cfeca307%40%3Cgeneral.hadoop.apache.org%3E
CVE ID: CVE-2016-6812 State: PUBLISHED Published: 2017-08-10T16:00:00Z Last Updated: 2024-09-17T00:51:19.414Z Vendors: Apache Software Foundation Products: Apache CXF Problem Types: XSS risk Description: The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix
e endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:0868 - http://cxf.apache.org/security-advisories.data/CVE-2016-6812.txt.asc - http://www.securitytracker.com/id/1037543 - https://issues.apache.org/jira/browse/CXF-6216 - http://www.securityfocus.com/bid/97582 - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://list
.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49
21e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2016-6813 State: PUBLISHED Published: 2018-02-06T14:00:00Z Last Updated: 2024-09-17T00:26:36.412Z Vendors: Apache Software Foundation Products: Apache CloudStack Problem Types: Information Disclosure Description: Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious user is able to determine the ID of another (non-"root") CloudStack user, the malicious user may be able to reset the API keys for the other user, in turn accessing their account and resources. Additional Analyst Notes: - CVE Program Container: References: - https://s.apache.org/qV5l - http://www.securityfocus.com/bid/93945 - http://
tes: - CVE Program Container: References: - https://s.apache.org/qV5l - http://www.securityfocus.com/bid/93945 - http://mail-archives.apache.org/mod_mbox/www-announce/201610.mbox/%3CCAJtfqCupOYQoNY2BNx86_zauses_MpmpiX8WciO_DEaWp6uNig%40mail.gmail.com%3E