Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-10171 State: PUBLISHED Published: 2019-08-02T13:49:35 Last Updated: 2024-08-04T22:10:10.034Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: RedHat Products: 389-ds-base Problem Types: CWE-770 Description: It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10171
CVE ID: CVE-2019-10172 State: PUBLISHED Published: 2019-11-18T16:16:02 Last Updated: 2024-08-04T22:10:09.989Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Redhat Products: jackson-mapper-asl Problem Types: CWE-611 Description: A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172 - https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html - https://lists.apache.org/thre
i?id=CVE-2019-10172 - https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html - https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20
aee86cf%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E - https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html - https://lists.apache.org/thread.html/r33d25a342a
- https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html - https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce
common-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E - https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E - https://li
he.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E - https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E - https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42
03581%40%3Cdev.hive.apache.org%3E - https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E - https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E
apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thre
cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E - https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E - https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E
CVE ID: CVE-2019-10173 State: PUBLISHED Published: 2019-07-23T12:50:44 Last Updated: 2024-08-04T22:10:10.018Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: xstream Products: xstream Problem Types: CWE-94 Description: It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285) Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:3892 - https://ac
ional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:3892 - https://access.redhat.com/errata/RHSA-2019:4352 - https://access.redhat.com/errata/RHSA-2020:0445 - https://access.redhat.com/errata/RHSA-2020:0727 - https://www.oracle.com/security-alerts/cpuapr2020.html - https://www.oracle.com/security-alerts/cpuoct2020.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10173 - http://x-stream.github.io/changes.html#1.4.11 - https://www.oracle.com/security-alerts/cpujan2021.html - https://www.oracle.com/security-alerts/cpuApr2021.html - https://www.oracle.com//security-alerts/cpujul2021.html
CVE ID: CVE-2019-10174 State: PUBLISHED Published: 2019-11-25T10:26:16 Last Updated: 2024-08-04T22:10:10.097Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: infinispan Problem Types: CWE-470 Description: A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174 - https://acces
Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10174 - https://access.redhat.com/errata/RHSA-2020:0481 - https://access.redhat.com/errata/RHSA-2020:0727 - https://security.netapp.com/advisory/ntap-20220210-0018/
CVE ID: CVE-2019-10175 State: PUBLISHED Published: 2019-06-28T19:55:40 Last Updated: 2024-08-04T22:10:10.092Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: KubeVirt Products: containerized-data-importer Problem Types: CWE-284, CWE-200 Description: A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data. Additional Analyst Notes: - C
in the cluster into their own namespace, effectively allowing access to other user's data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10175
CVE ID: CVE-2019-10176 State: PUBLISHED Published: 2019-08-02T13:51:09 Last Updated: 2024-08-04T22:10:09.971Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: RedHat Products: atomic-openshift Problem Types: CWE-352 Description: A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10176
itional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10176 - https://access.redhat.com/errata/RHSA-2019:2792 - https://access.redhat.com/errata/RHSA-2019:4053
CVE ID: CVE-2019-10177 State: PUBLISHED Published: 2019-06-27T20:50:45 Last Updated: 2024-08-04T22:10:10.027Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Red Hat Products: CloudForms Problem Types: CWE-79 Description: A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Additional Analyst Notes: - CVE Program Container: Reference
traction of the anti-CSRF token of higher privileged users. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10177 - http://www.securityfocus.com/bid/109065
CVE ID: CVE-2019-10178 State: PUBLISHED Published: 2020-03-18T14:57:08 Last Updated: 2024-08-04T22:10:10.069Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: The pki-core Project Products: pki-core Problem Types: CWE-79 Description: It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable. Additional Analyst
ary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10178
CVE ID: CVE-2019-10179 State: PUBLISHED Published: 2020-03-20T13:57:04 Last Updated: 2024-08-04T22:10:09.976Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: [UNKNOWN] Products: pki-core/pki-kra Problem Types: CWE-79 Description: A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?i
script code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10179
CVE ID: CVE-2019-10180 State: PUBLISHED Published: 2020-03-31T16:31:52 Last Updated: 2024-08-04T22:10:10.027Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: pki-core Problem Types: CWE-79 Description: A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code. Additional Analyst Notes: - CVE Program Container: Referenc
authenticated user into executing arbitrary JavaScript code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10180
CVE ID: CVE-2019-10181 State: PUBLISHED Published: 2019-07-31T21:56:11 Last Updated: 2024-08-04T22:10:09.998Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: IcedTea Products: icedtea-web Problem Types: CWE-345 Description: It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 executable code could be injected in a JAR file without compromising the signature verification. An attacker could use this flaw to inject code in a trusted JAR. The code would be executed inside the sandbox. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 - https://github.com/AdoptOpenJDK/IcedTea-Web/
ainer: References: - https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 - https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10181 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html - https://seclists.org/bugtraq/2019/Oct/5 - http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html - https://security.gentoo.org/glsa/202107-51
CVE ID: CVE-2019-10182 State: PUBLISHED Published: 2019-07-31T21:52:39 Last Updated: 2024-08-04T22:10:09.992Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L) Vendors: IcedTea Products: icedtea-web Problem Types: CWE-22, CWE-94 Description: It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files. An attacker could trick a victim into running a specially crafted application and use this flaw to upload arbitrary files to arbitrary locations in the context of the user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182 - https://github.co
s: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10182 - https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 - https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html - https://seclists.org/bugtraq/2019/Oct/5 - http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html
CVE ID: CVE-2019-10183 State: PUBLISHED Published: 2019-07-03T13:36:47 Last Updated: 2024-08-04T22:10:09.993Z Severity: LOW (CVSS 3.2 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N) Vendors: Red Hat Products: virt-install Problem Types: CWE-200 Description: Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cg
v2.2.0 release. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10183 - http://www.securityfocus.com/bid/109027 - https://access.redhat.com/errata/RHSA-2019:3464
CVE ID: CVE-2019-10184 State: PUBLISHED Published: 2019-07-25T20:35:16 Last Updated: 2024-08-04T22:10:10.116Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: undertow-io Products: undertow Problem Types: CWE-862 Description: undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2019:2937 - https://access.redhat.com/errata/RHSA-2019:2935 - https://access.redhat.com/errata/RHSA-2019:2936 - https://access.redhat.com/errata/RH
redhat.com/errata/RHSA-2019:2935 - https://access.redhat.com/errata/RHSA-2019:2936 - https://access.redhat.com/errata/RHSA-2019:2938 - https://access.redhat.com/errata/RHSA-2019:2998 - https://access.redhat.com/errata/RHSA-2019:3044 - https://access.redhat.com/errata/RHSA-2019:3045 - https://access.redhat.com/errata/RHSA-2019:3050 - https://access.redhat.com/errata/RHSA-2019:3046 - https://access.redhat.com/errata/RHSA-2020:0727 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184 - https://github.com/undertow-io/undertow/pull/794 - https://security.netapp.com/advisory/ntap-20220210-0016/
CVE ID: CVE-2019-10185 State: PUBLISHED Published: 2019-07-31T21:50:57 Last Updated: 2024-08-04T22:10:10.092Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L) Vendors: IcedTea Products: icedtea-web Problem Types: CWE-22 Description: It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 - https://g
l Analyst Notes: - CVE Program Container: References: - https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344 - https://github.com/AdoptOpenJDK/IcedTea-Web/issues/327 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10185 - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00045.html - https://lists.debian.org/debian-lts-announce/2019/09/msg00008.html - https://seclists.org/bugtraq/2019/Oct/5 - http://packetstormsecurity.com/files/154748/IcedTeaWeb-Validation-Bypass-Directory-Traversal-Code-Execution.html - https://security.gentoo.org/glsa/202107-51
CVE ID: CVE-2019-10186 State: PUBLISHED Published: 2019-07-31T21:40:55 Last Updated: 2024-08-04T22:10:10.036Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: The Moodle Project Products: moodle Problem Types: CWE-352 Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109175 - https://moodle.org/mod/forum/discuss.php?d=388567#p1566329 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10186
CVE ID: CVE-2019-10187 State: PUBLISHED Published: 2019-07-31T21:39:40 Last Updated: 2024-08-04T22:17:18.420Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Moodle Project Products: moodle Problem Types: CWE-284 Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109174 - https://moodle.org/mod/forum/discuss.php?d=388568#p1566330 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187
CVE ID: CVE-2019-10188 State: PUBLISHED Published: 2019-07-31T21:29:44 Last Updated: 2024-08-04T22:17:18.952Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Moodle Project Products: moodle Problem Types: CWE-284 Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109178 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10188 - https://moodle.org/mod/forum/discuss.php?d=388569
CVE ID: CVE-2019-10189 State: PUBLISHED Published: 2019-07-31T21:27:36 Last Updated: 2024-08-04T22:17:18.440Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: The Moodle Project Products: moodle Problem Types: CWE-284 Description: A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/109271 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10189 - https://moodle.org/mod/forum/discuss.php?d=388570
CVE ID: CVE-2019-10190 State: PUBLISHED Published: 2019-07-16T17:50:05.000Z Last Updated: 2025-02-13T16:27:20.781Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: CZ.NIC Products: knot-resolver Problem Types: CWE-20 Description: A vulnerability was discovered in DNS resolver component of knot resolver through version 3.2.0 before 4.1.0 which allows remote attackers to bypass DNSSEC validation for non-existence answer. NXDOMAIN answer would get passed through to the client even if its DNSSEC validation failed, instead of sending a SERVFAIL packet. Caching is not affected by this particular bug but see CVE-2019-10191. Additional Analyst Notes: - CVE Program Co