Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-11742 State: PUBLISHED Published: 2018-12-26T20:00:00 Last Updated: 2024-08-05T08:17:09.093Z Vendors: n/a Products: n/a Problem Types: n/a Description: NEC Univerge Sv9100 WebPro 6.00.00 devices have Cleartext Password Storage in the Web UI. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/150610/NEC-Univerge-Sv9100-WebPro-6.00.00-Predictable-Session-ID-Cleartext-Passwords.html - https://www.exploit-db.com/exploits/45942/ - http://seclists.org/fulldisclosure/2018/Dec/1 - http://hyp3rlinx.altervista.org/advisories/NEC-UNIVERGE-WEBPRO-v6.00-PREDICTABLE-SESSIONID-CLEARTEXT-PASSWORDS.txt
CVE ID: CVE-2018-11743 State: PUBLISHED Published: 2018-06-05T13:00:00 Last Updated: 2024-08-05T08:17:09.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: The init_copy function in kernel.c in mruby 1.4.1 makes initialize_copy calls for TT_ICLASS objects, which allows attackers to cause a denial of service (mrb_hash_keys uninitialized pointer and application crash) or possibly have unspecified other impact. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/commit/b64ce17852b180dfeea81cf458660be41a78974d - https://github.com/mruby/mruby/issues/4027 - https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html
CVE ID: CVE-2018-11744 State: PUBLISHED Published: 2019-07-11T13:35:25 Last Updated: 2024-08-05T08:17:09.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cloudera Manager through 5.15 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html#cloudera_manager - https://www.cloudera.com/documentation/other/security-bulletins/topics/Security-Bulletin.html
CVE ID: CVE-2018-11746 State: PUBLISHED Published: 2018-07-03T13:00:00Z Last Updated: 2024-09-16T23:55:51.656Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Puppet Products: Puppet Discovery Problem Types: Insufficiently Protected Credentials Description: In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2018-11746 - https://lists.apache.org/thread.h
CVE Program Container: References: - https://puppet.com/security/cve/CVE-2018-11746 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2018-11747 State: PUBLISHED Published: 2019-03-17T19:16:13 Last Updated: 2024-08-05T08:17:08.991Z Vendors: Puppet Products: Puppet Discovery Problem Types: Insecure default Description: Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2018-11747 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2018-11748 State: PUBLISHED Published: 2018-10-02T19:00:00 Last Updated: 2024-08-05T08:17:09.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved as of device_manager 2.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2018-11748
CVE ID: CVE-2018-11749 State: PUBLISHED Published: 2018-08-24T13:00:00Z Last Updated: 2024-09-16T22:44:55.842Z Vendors: Puppet Products: Puppet Enterprise Problem Types: Improper Authentication Description: When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/cve-2018-11749
CVE ID: CVE-2018-11750 State: PUBLISHED Published: 2018-10-02T19:00:00 Last Updated: 2024-08-05T08:17:09.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, host key checking is enabled by default. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2018-11750
CVE ID: CVE-2018-11751 State: PUBLISHED Published: 2019-12-16T21:39:30 Last Updated: 2024-08-05T08:17:09.111Z Vendors: n/a Products: Puppet Agent, Puppet Problem Types: Improper Certificate Validation Description: Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2018-11751
CVE ID: CVE-2018-11752 State: PUBLISHED Published: 2018-10-02T19:00:00 Last Updated: 2024-08-05T08:17:08.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file on every run. These issues have been resolved in the 0.4.0 release. Additional Analyst Notes: - CVE Program Container: References: - https://puppet.com/security/cve/CVE-2018-11752
CVE ID: CVE-2018-11756 State: PUBLISHED Published: 2018-07-23T17:00:00Z Last Updated: 2024-09-16T17:03:31.828Z Vendors: Apache Software Foundation Products: PHP Runtime for Apache OpenWhisk Problem Types: Information Disclosure Description: In PHP Runtime for Apache OpenWhisk, a Docker action inheriting one of the Docker tags openwhisk/action-php-v7.2:1.0.0 or openwhisk/action-php-v7.1:1.0.1 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apache/incubator-openwhisk-runtime-php/commit/6caf902f527250ee4b7b695929b628d560e0d
er: References: - https://github.com/apache/incubator-openwhisk-runtime-php/commit/6caf902f527250ee4b7b695929b628d560e0dad1 - https://lists.apache.org/thread.html/439bd5ff5822708c645a0d816ed9914b88c97eda32eae6ea211bc0dc%40%3Cdev.openwhisk.apache.org%3E - http://www.securityfocus.com/bid/104915
CVE ID: CVE-2018-11757 State: PUBLISHED Published: 2018-07-23T17:00:00Z Last Updated: 2024-09-16T22:20:06.215Z Vendors: Apache Software Foundation Products: Docker Skeleton Runtime for Apache OpenWhisk Problem Types: Information Disclosure Description: In Docker Skeleton Runtime for Apache OpenWhisk, a Docker action inheriting the Docker tag openwhisk/dockerskeleton:1.3.0 (or earlier) may allow an attacker to replace the user function inside the container if the user code is vulnerable to code exploitation. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/104913 - https://lists.apache.org/thread.html/0b6d8a677f1c063ed32eb3638ef4d1a47dfba8907de
tp://www.securityfocus.com/bid/104913 - https://lists.apache.org/thread.html/0b6d8a677f1c063ed32eb3638ef4d1a47dfba8907de4b222ddd24b05%40%3Cdev.openwhisk.apache.org%3E - https://github.com/apache/incubator-openwhisk-runtime-docker/commit/891896f25c39bc336ef6dda53f80f466ac4ca3c8
CVE ID: CVE-2018-11758 State: PUBLISHED Published: 2018-08-22T21:00:00Z Last Updated: 2024-09-16T20:07:21.956Z Vendors: Apache Software Foundation Products: Apache Cayenne Problem Types: Information Disclosure Description: This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a malicious XML file, the attacker will be able to instruct the XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the att
he XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the attacker. The cause of the issue is XML parser processing XML External Entity (XXE) declarations included in XML. The vulnerability is addressed in Cayenne by disabling XXE processing in all operations that require XML parsing. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ed60a4d329be3c722f105317ca883986dfcd17615c70d1df87f4528c%40%3Cuser.cayenne.apache.org%3E - http://www.securityfocus.com/bid/105142
CVE ID: CVE-2018-11759 State: PUBLISHED Published: 2018-10-31T20:00:00 Last Updated: 2024-08-05T08:17:08.977Z Vendors: Apache Software Foundation Products: Apache Tomcat Connectors Problem Types: Information Disclosure Description: The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the applicatio
to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4357 - https://access.redhat.com/errata/RHSA-2019:0367 - http://www.securityfocus.com/bid/105888 - https://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad%40%3Cannounce.tomcat.apache.org%3E
ists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad%40%3Cannounce.tomcat.apache.org%3E - https://lists.debian.org/debian-lts-announce/2018/12/msg00007.html - https://access.redhat.com/errata/RHSA-2019:0366 - https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1
981925%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3E - https://www.oracle.com/security-alerts/cpujan2020.html - https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E - https://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3E
CVE ID: CVE-2018-11760 State: PUBLISHED Published: 2019-02-04T17:00:00Z Last Updated: 2024-09-16T19:19:24.731Z Vendors: Apache Software Foundation Products: Apache Spark Problem Types: Gain Privileges Description: When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106786 - https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b%40%3Cuser.spark.apache.org%3E - https://lists.apache.o
ead.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b%40%3Cuser.spark.apache.org%3E - https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e%40%3Ccommits.spark.apache.org%3E
CVE ID: CVE-2018-11761 State: PUBLISHED Published: 2018-09-19T14:00:00Z Last Updated: 2024-09-16T18:39:59.951Z Vendors: Apache Software Foundation Products: Apache Tika Problem Types: Denial of Service via XML Entity Expansion Description: In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105514 - https://lists.apache.org/thread.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421%40%3Cdev.tika.apache.org%3E - https://lists.apache.org
ead.html/5553e10bba5604117967466618f219c0cae710075819c70cfb3fb421%40%3Cdev.tika.apache.org%3E - https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
CVE ID: CVE-2018-11762 State: PUBLISHED Published: 2018-09-19T14:00:00Z Last Updated: 2024-09-16T20:26:36.852Z Vendors: Apache Software Foundation Products: Apache Tika Problem Types: Zip Slip Vulnerability in Apache Tika's tika-app Description: In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and the input file has an embedded file with an absolute path, such as "C:/evil.bat", tika-app would overwrite that file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105515 - https://lists.apache.org/thread.html/ab2e1af38975f5fc462ba89b517971ef892ec3d06bee12ea22588
ecurityfocus.com/bid/105515 - https://lists.apache.org/thread.html/ab2e1af38975f5fc462ba89b517971ef892ec3d06bee12ea2258895b%40%3Cdev.tika.apache.org%3E
CVE ID: CVE-2018-11763 State: PUBLISHED Published: 2018-09-25T21:00:00Z Last Updated: 2024-09-17T02:21:55.083Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: mod_http2, DoS via continuous SETTINGS frames Description: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.re
ontainer: References: - https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html - https://access.redhat.com/errata/RHSA-2018:3558 - http://www.securityfocus.com/bid/105414 - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us - https://security.netapp.com/advisory/ntap-20190204-0004/ - https://access.redhat.com/errata/RHSA-2019:0367 - https://usn.ubuntu.com/3783-1/ - https://httpd.apache.org/security/vulnerabilities_24.html - http://www.securitytracker.com/id/1041713 - https://access.redhat.com/errata/RHSA-2019:0366 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - http://lists.opensuse.org/opensus
:0366 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html - http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html - https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E - https://www.tenable.com/security/tns-2019-09 - https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html
3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.ap
rg%3E - https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E - https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
CVE ID: CVE-2018-11764 State: PUBLISHED Published: 2020-10-21T18:13:56 Last Updated: 2024-08-05T08:17:09.093Z Vendors: n/a Products: Apache Hadoop Problem Types: Privilege Escalation Description: Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r790ad0a049cde713b93589ecfd4dd2766fda0fc6807eedb6cf69f5c1%40%3Cgeneral.hadoop.apache.org%3E - https://security.netapp.com/advisory/ntap-20201103-0003/
CVE ID: CVE-2018-11765 State: PUBLISHED Published: 2020-09-30T17:02:20 Last Updated: 2024-08-05T08:17:09.112Z Vendors: n/a Products: Apache Hadoop Problem Types: Information Disclosure Description: In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/r2c7f899911a04164ed1707083fcd4135f8427e04778c87d83509b0da%40%3Cgeneral.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rf9dfa8b77585c9227db9637552eebb2ab029255a0db4eb76c
3Cgeneral.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rf9dfa8b77585c9227db9637552eebb2ab029255a0db4eb76c2b6c4cf%40%3Cdev.druid.apache.org%3E - https://lists.apache.org/thread.html/rbe25cac0f499374f8ae17a4a44a8404927b56de28d4c41940d82b7a4%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r4dddf1705dbedfa94392913b2dad1cd2d1d89040facd389eea0b3510%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r79b15c5b66c6df175d01d7560adf0cd5c369129b9a161905e0339927%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/reea5eb8622afbfbfca46bc758f79db83d90a3263a906c4d1acba4971%40%3Ccommits.druid.apache.org%3E - https://lists.apache.
.html/reea5eb8622afbfbfca46bc758f79db83d90a3263a906c4d1acba4971%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rb21df54a4e39732ce653d2aa5672e36a792b59eb6717f2a06bb8d02a%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r46447f38ea8c89421614e9efd7de5e656186d35e10fc97cf88477a01%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r17d94d132b207dad221595fd8b8b18628f5f5ec7e3f5be939ecd8928%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/rb241464d83baa3749b08cd3dabc8dba70a9a9027edcef3b5d4c24ef4%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r74825601e93582167eb7cdc2f764c74c9c6d8006fa9
ef4%40%3Ccommits.druid.apache.org%3E - https://lists.apache.org/thread.html/r74825601e93582167eb7cdc2f764c74c9c6d8006fa90018562fda60f%40%3Ccommits.druid.apache.org%3E - https://security.netapp.com/advisory/ntap-20201016-0005/
CVE ID: CVE-2018-11766 State: PUBLISHED Published: 2018-11-27T14:00:00 Last Updated: 2024-08-05T08:17:09.256Z Vendors: Apache Software Foundation Products: Apache Hadoop Problem Types: Privilege Escalation Description: In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/106035 - https://lists.apache.org/thread.html/ff37bbbe09d5f03090e2dd2c3dea95de16ef4249e731f19b8959ce4c%40%3Cgeneral.hadoop.apache.org%3E
CVE ID: CVE-2018-11767 State: PUBLISHED Published: 2019-03-18T13:41:17 Last Updated: 2024-08-05T08:17:08.999Z Vendors: n/a Products: Apache Hadoop Problem Types: Privilege Escalation Description: In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/5fb771f66946dd5c99a8a5713347c24873846f555d716f9ac17bccca%40%3Cgeneral.hadoop.apache.org%3E - https://lists.apache.org/thread.html/246cf223e7dc0c1dff90b78dccb6c3fe94e1a044dbf98e2333393302%40%3Ccommon-issues.hadoop.apache
//lists.apache.org/thread.html/246cf223e7dc0c1dff90b78dccb6c3fe94e1a044dbf98e2333393302%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/5a44590b4eedc5e25f5bd3081d1631b52c174b5b99157f7950ddc270%40%3Ccommon-dev.hadoop.apache.org%3E - https://security.netapp.com/advisory/ntap-20190416-0009/ - https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
CVE ID: CVE-2018-11768 State: PUBLISHED Published: 2019-10-04T13:56:56 Last Updated: 2024-08-05T08:17:09.225Z Vendors: n/a Products: Apache Hadoop Problem Types: Information Disclosure Description: In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/2067a797b330530a6932f4b08f703b3173253d0a2b7c8c524e54adaf%40%3Cgeneral.hadoop.apache.org%3E - https://lists.apache.org/thread.html/caacbbba2dcc1105163f76f3dfee5fbd22e0417e0783212787086378%40%3Cgeneral.h
he.org%3E - https://lists.apache.org/thread.html/caacbbba2dcc1105163f76f3dfee5fbd22e0417e0783212787086378%40%3Cgeneral.hadoop.apache.org%3E - https://lists.apache.org/thread.html/ea6d2dfbefab8ebe46be18b05136b83ae53b7866f1bc60c680a2b600%40%3Chdfs-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/2c9cc65864be0058a5d5ed2025dfb9c700bf23d352b0c826c36ff96a%40%3Chdfs-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/f20bb4e055d8394fc525cc7772fb84096f706389043e76220c8a29a4%40%3Chdfs-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/ceb16af9139ab0fea24aef935b6321581976887df7ad632e9a515dda%40%3Cdev.lucene.apache.org%3E - https://lists.apache.org/thread.html/9b