Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-0020 State: PUBLISHED Published: 2014-02-06T15:00:00 Last Updated: 2024-08-06T08:58:26.563Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html - http://hg.pidgin.im/pidgin/main/rev/a167504359e5 - https://rhn.redhat.com/errata/RHSA-2014-0139.html - http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd - http://www.debian.org/security/2014/dsa-2859 -
/RHSA-2014-0139.html - http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd - http://www.debian.org/security/2014/dsa-2859 - http://pidgin.im/news/security/?id=85 - http://hg.pidgin.im/pidgin/main/rev/4d9be297d399 - http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html - http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20 - http://www.ubuntu.com/usn/USN-2100-1 - http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4 - http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084
CVE ID: CVE-2014-0021 State: PUBLISHED Published: 2019-11-15T14:35:31 Last Updated: 2024-08-06T08:58:26.538Z Vendors: Chrony Products: Chrony Problem Types: amplification in cmdmon protocol Description: Chrony before 1.29.1 has traffic amplification in cmdmon protocol Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2014-0021 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0021 - http://www.openwall.com/lists/oss-security/2014/01/18/2 - http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127837.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128753.html - http://www.openw
ary/127837.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128753.html - http://www.openwall.com/lists/oss-security/2014/01/17/9 - http://www.openwall.com/lists/oss-security/2014/01/18/1 - http://www.openwall.com/lists/oss-security/2014/01/18/3 - http://www.openwall.com/lists/oss-security/2014/01/19/1 - http://www.securityfocus.com/bid/65035 - https://exchange.xforce.ibmcloud.com/vulnerabilities/90925
CVE ID: CVE-2014-0022 State: PUBLISHED Published: 2014-01-26T11:00:00 Last Updated: 2024-08-06T08:58:26.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/65119 - http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794 - http://secunia.com/advisories/56637 - https://bugzilla.redhat.com/show_bug.cgi?id=1052440 - https://bugzil
=9df69e5794 - http://secunia.com/advisories/56637 - https://bugzilla.redhat.com/show_bug.cgi?id=1052440 - https://bugzilla.redhat.com/show_bug.cgi?id=1057377
CVE ID: CVE-2014-0023 State: PUBLISHED Published: 2019-11-15T14:40:12 Last Updated: 2024-08-06T08:58:26.621Z Vendors: OpenShift Products: OpenShift Problem Types: install script has temporary file creation vulnerability Description: OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0023 - https://access.redhat.com/security/cve/cve-2014-0023
CVE ID: CVE-2014-0024 State: REJECTED Published: 2022-07-07T15:57:32 Last Updated: 2022-07-07T15:57:32 Description: No description available.
CVE ID: CVE-2014-0025 State: REJECTED Published: 2014-01-28T23:00:00 Last Updated: 2014-01-28T22:57:01 Description: No description available.
CVE ID: CVE-2014-0026 State: PUBLISHED Published: 2019-12-11T14:07:02 Last Updated: 2024-08-06T08:58:26.618Z Vendors: katello-headpin Products: katello-headpin Problem Types: CSRF in REST API Description: katello-headpin is vulnerable to CSRF in REST API Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0026 - https://access.redhat.com/security/cve/cve-2014-0026
CVE ID: CVE-2014-0027 State: PUBLISHED Published: 2014-01-26T01:00:00 Last Updated: 2024-08-06T08:58:26.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127776.html - http://www.securityfocus.com/bid/64791 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:032 - http://www.osvdb.org/101948 - https://bugzilla.redha
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:032 - http://www.osvdb.org/101948 - https://bugzilla.redhat.com/show_bug.cgi?id=1048678 - http://seclists.org/oss-sec/2014/q1/59 - http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127748.html
CVE ID: CVE-2014-0028 State: PUBLISHED Published: 2014-01-24T18:00:00 Last Updated: 2024-08-06T08:58:26.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2093-1 - http://libvirt.org/news.html - http://secunia.com/advisories/60895 - http://security.gentoo.org/glsa/gls
sn/USN-2093-1 - http://libvirt.org/news.html - http://secunia.com/advisories/60895 - http://security.gentoo.org/glsa/glsa-201412-04.xml - http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html - https://www.redhat.com/archives/libvir-list/2014-January/msg00684.html - https://bugzilla.redhat.com/show_bug.cgi?id=1048637
CVE ID: CVE-2014-0029 State: PUBLISHED Published: 2017-10-16T13:00:00 Last Updated: 2024-08-06T08:58:26.544Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1059433
CVE ID: CVE-2014-0030 State: PUBLISHED Published: 2017-10-09T14:00:00 Last Updated: 2024-08-06T08:58:26.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/45341/ - https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/ - https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%40mail.gmail.com%3E
CVE ID: CVE-2014-0031 State: PUBLISHED Published: 2014-01-14T18:00:00 Last Updated: 2024-08-06T08:58:26.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/55960 - https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl - https://issues.apache.org/jira/browse/CLOUDSTACK-5145
CVE ID: CVE-2014-0032 State: PUBLISHED Published: 2014-02-14T15:00:00 Last Updated: 2024-08-06T08:58:26.658Z Vendors: n/a Products: n/a Problem Types: n/a Description: The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command. Additional Analyst Notes: - CVE Program Container: References: - http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES - http://secunia.com/advisories/56822 - http://s
rences: - http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES - http://secunia.com/advisories/56822 - http://secunia.com/advisories/61321 - http://www.ubuntu.com/usn/USN-2316-1 - http://www.osvdb.org/102927 - http://rhn.redhat.com/errata/RHSA-2014-0255.html - http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502%40reser.org%3E - http://svn.apache.org/viewvc?view=revision&revision=1557320 - http://www.securityfocus.com/bid/65434 - http://support.apple.com/kb/HT6444 - http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA%40mail.gmail.com%3E - http://lists.opensuse.org/opensuse-updat
ox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA%40mail.gmail.com%3E - http://lists.opensuse.org/opensuse-updates/2014-02/msg00086.html - http://secunia.com/advisories/60722 - http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf%40ntlworld.com%3E - http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES - https://exchange.xforce.ibmcloud.com/vulnerabilities/90986 - http://lists.opensuse.org/opensuse-updates/2014-03/msg00011.html - https://security.gentoo.org/glsa/201610-05 - http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
CVE ID: CVE-2014-0033 State: PUBLISHED Published: 2014-02-26T11:00:00 Last Updated: 2024-08-06T08:58:26.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1069919 - http://svn.apache.org/viewvc?view=revision&revision=1558822 - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securityfocus.co
=revision&revision=1558822 - http://www.vmware.com/security/advisories/VMSA-2014-0012.html - http://www.securityfocus.com/bid/65769 - http://www.debian.org/security/2016/dsa-3530 - http://www.securityfocus.com/archive/1/534161/100/0/threaded - http://www-01.ibm.com/support/docview.wss?uid=swg21677147 - http://www-01.ibm.com/support/docview.wss?uid=swg21678231 - http://secunia.com/advisories/59722 - http://tomcat.apache.org/security-6.html - http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html - http://www.ubuntu.com/usn/USN-2130-1 - http://secunia.com/advisories/59873 - http://seclists.org/fulldisclosure/2014/Dec/23 - http://www.oracle.com/technetwork/topics/security/cpu
dvisories/59873 - http://seclists.org/fulldisclosure/2014/Dec/23 - http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html - http://www-01.ibm.com/support/docview.wss?uid=swg21675886 - http://secunia.com/advisories/59036 - https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbadad84c236d85eab3033662cfb%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1aea04ccdc3b2e639dcd903b%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783b2930fbeae3a17f1333113%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e
333113%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e5b8b2930be9e132d5cef6b95%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa23300c3d6c9fe589ab87fe02859c%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d50294072d142fd6dc08a8987ae9f3a9b%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2014-0034 State: PUBLISHED Published: 2014-07-07T14:00:00 Last Updated: 2024-08-06T08:58:26.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0798.html - http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc - http://www.securityfocus.com/bid/68441 - http://svn.apache.org/viewvc?view=revision&revision=1551228 - http://rhn.redhat.com/er
www.securityfocus.com/bid/68441 - http://svn.apache.org/viewvc?view=revision&revision=1551228 - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://rhn.redhat.com/errata/RHSA-2014-0797.html - http://rhn.redhat.com/errata/RHSA-2015-0851.html - http://rhn.redhat.com/errata/RHSA-2014-0799.html - http://rhn.redhat.com/errata/RHSA-2014-1351.html - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd
ommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2014-0035 State: PUBLISHED Published: 2014-07-07T14:00:00 Last Updated: 2024-08-06T08:58:26.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2014-0798.html - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://cxf.apache.org/security-advisories.data/CVE-2014-0
0798.html - http://rhn.redhat.com/errata/RHSA-2015-0850.html - http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc - http://rhn.redhat.com/errata/RHSA-2014-0797.html - http://rhn.redhat.com/errata/RHSA-2015-0851.html - http://rhn.redhat.com/errata/RHSA-2014-0799.html - http://svn.apache.org/viewvc?view=revision&revision=1564724 - http://rhn.redhat.com/errata/RHSA-2014-1351.html - https://lists.apache.org/thread.html/rc774278135816e7afc943dc9fc78eb0764f2c84a2b96470a0187315c%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/r36e44ffc1a9b365327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cf
5327df62cdfaabe85b9a5637de102cea07d79b2dbf%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rff42cfa5e7d75b7c1af0e37589140a8f1999e578a75738740b244bd4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rd49aabd984ed540c8ff7916d4d79405f3fa311d2fdbcf9ed307839a6%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rec7160382badd3ef4ad017a22f64a266c7188b9ba71394f0d321e2d4%40%3Ccommits.cxf.apache.org%3E - https://lists.apache.org/thread.html/rfb87e0bf3995e7d560afeed750fac9329ff5f1ad49da365129b7f89e%40%3Ccommits.cxf.apache.org%3E
CVE ID: CVE-2014-0036 State: PUBLISHED Published: 2014-04-17T14:00:00 Last Updated: 2024-08-06T08:58:26.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130148.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130180.html - http://seclists.org/oss-sec/2014/q1/509 - https://bugzilla.redhat.com/show_bug.cgi?id=1058595
CVE ID: CVE-2014-0037 State: PUBLISHED Published: 2014-04-28T14:00:00 Last Updated: 2024-08-06T08:58:26.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username." Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1056767 - http://www.openwall.com/lists/oss-security/2014/01/31/14 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:044 - https://bugzilla.redhat.com/show_bug.cgi?id=1059903
CVE ID: CVE-2014-0038 State: PUBLISHED Published: 2014-02-06T22:00:00 Last Updated: 2024-08-06T08:58:26.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2def2ef2ae5f3990aabdbe8a755911902707d268 - http://www.ubuntu.com/usn/USN-2096-1 - https://github.com/saelo/cve-2014-0038 - http://www.ubuntu.com/usn/USN-2095-1 - ht
ttp://www.ubuntu.com/usn/USN-2096-1 - https://github.com/saelo/cve-2014-0038 - http://www.ubuntu.com/usn/USN-2095-1 - http://pastebin.com/raw.php?i=DH3Lbg54 - https://code.google.com/p/chromium/issues/detail?id=338594 - http://www.ubuntu.com/usn/USN-2094-1 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:038 - http://secunia.com/advisories/56669 - http://www.securityfocus.com/bid/65255 - https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268 - https://www.exploit-db.com/exploits/40503/ - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2 - https://bugzilla.redhat.com/show_bug.cgi?id=1060023 - http://lists.opensuse.org/opensuse-security-announ
ngeLog-3.13.2 - https://bugzilla.redhat.com/show_bug.cgi?id=1060023 - http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html - http://www.exploit-db.com/exploits/31347 - http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html - http://www.exploit-db.com/exploits/31346 - http://www.openwall.com/lists/oss-security/2014/01/31/2
CVE ID: CVE-2014-0039 State: PUBLISHED Published: 2014-02-08T00:00:00 Last Updated: 2024-08-06T08:58:26.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mrash/fwsnort/blob/master/ChangeLog - http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128188.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128205.html - http://osvdb.org/102822 - http://www.sec
/lists.fedoraproject.org/pipermail/package-announce/2014-February/128205.html - http://osvdb.org/102822 - http://www.securityfocus.com/bid/65341 - https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348 - http://seclists.org/oss-sec/2014/q1/221
CVE ID: CVE-2014-0040 State: PUBLISHED Published: 2014-06-02T15:00:00 Last Updated: 2024-08-06T08:58:26.545Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/heat-templates/+bug/1267635 - https://bugzilla.redhat.com/show_bug.cgi?id=1059514 - https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e3
ugzilla.redhat.com/show_bug.cgi?id=1059514 - https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3 - http://rhn.redhat.com/errata/RHSA-2014-0579.html
CVE ID: CVE-2014-0041 State: PUBLISHED Published: 2014-06-02T15:00:00 Last Updated: 2024-08-06T08:58:26.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3CONFIRM: - https://bugs.launchpad.net/heat-templates/+bug/1267635 - https://bugzilla.redhat.com/show_bug.c
b7b1ac354db1a3CONFIRM: - https://bugs.launchpad.net/heat-templates/+bug/1267635 - https://bugzilla.redhat.com/show_bug.cgi?id=1059515 - http://rhn.redhat.com/errata/RHSA-2014-0579.html
CVE ID: CVE-2014-0042 State: PUBLISHED Published: 2014-06-02T15:00:00 Last Updated: 2024-08-06T08:58:26.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/heat-templates/+bug/1267635 - https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3 - https://bugzilla
1267635 - https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3 - https://bugzilla.redhat.com/show_bug.cgi?id=1059520 - http://rhn.redhat.com/errata/RHSA-2014-0579.html
CVE ID: CVE-2014-0043 State: PUBLISHED Published: 2017-10-02T13:00:00Z Last Updated: 2024-09-16T19:56:10.491Z Vendors: Apache Software Foundation Products: Apache Wicket Problem Types: Information Disclosure Description: In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d%401392986987%40%3Cannounce.wicket.apache.org%3E