Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
la.redhat.com/show_bug.cgi?id=856300 - http://git.gnome.org/browse/gegl/commit/?id=4757cdf73d3675478d645a3ec8250ba02168a230 - http://lists.opensuse.org/opensuse-updates/2013-01/msg00054.html - http://secunia.com/advisories/51114 - http://www.securityfocus.com/bid/56404 - http://secunia.com/advisories/51274 - http://git.gnome.org/browse/gegl/commit/?id=1e92e5235ded0415d555aa86066b8e4041ee5a53 - http://rhn.redhat.com/errata/RHSA-2012-1455.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/79822 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:081 - http://www.openwall.com/lists/oss-security/2012/11/06/1 - http://www.securitytracker.com/id?1027754
CVE ID: CVE-2012-4434 State: PUBLISHED Published: 2020-01-09T20:30:49 Last Updated: 2024-08-06T20:35:09.742Z Vendors: fwknop Products: fwknop Problem Types: Buffer Overflow Description: fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/19/2 - http://www.openwall.com/lists/oss-security/2012/09/20/4 - http://www.cipherdyne.org/blog/2012/09/software-release-fwknop-2.0.3.html
CVE ID: CVE-2012-4435 State: PUBLISHED Published: 2012-10-22T23:00:00 Last Updated: 2024-08-06T20:35:09.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: fwknop before 2.0.3 does not properly validate IP addresses, which allows remote authenticated users to cause a denial of service (server crash) via a long IP address. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/79568 - http://www.openwall.com/lists/oss-security/2012/09/19/2 - http://www.openwall.com/lists/oss-security/2012/09/20/4 - http://www.cipherdyne.org/blog/2012/09/software-release-fwknop-2.0.3.html - http://www.cipherdyne.org/cgi-bin/gitweb.cgi?p
tp://www.cipherdyne.org/blog/2012/09/software-release-fwknop-2.0.3.html - http://www.cipherdyne.org/cgi-bin/gitweb.cgi?p=fwknop.git%3Ba=commitdiff%3Bh=263fa01f2af1d336961df320f1c7a9ea84ddac9a - http://www.cipherdyne.org/cgi-bin/gitweb.cgi?p=fwknop.git%3Ba=commitdiff%3Bh=f4c16bc47fc24a96b63105556b62d61c1ba7d799 - http://www.openwall.com/lists/oss-security/2012/09/20/2
CVE ID: CVE-2012-4436 State: PUBLISHED Published: 2012-10-22T23:00:00Z Last Updated: 2024-09-16T19:10:39.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/19/2 - http://www.openwall.com/lists/oss-security/2012/09/20/4 - http://www.cipherdyne.org/blog/2012/09/software-release-fwknop-2.0.3.html - http://www.cipherdyne.org
ity/2012/09/20/4 - http://www.cipherdyne.org/blog/2012/09/software-release-fwknop-2.0.3.html - http://www.cipherdyne.org/cgi-bin/gitweb.cgi?p=fwknop.git%3Ba=commitdiff%3Bh=a60f05ad44e824f6230b22f8976399340cb535dc
CVE ID: CVE-2012-4437 State: PUBLISHED Published: 2012-10-01T01:00:00 Last Updated: 2024-08-06T20:35:09.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/19/1 - http://lists.fedoraproject.org/pipermail/package-announce/2012-September/088138.html - http://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt - http:
2012-September/088138.html - http://code.google.com/p/smarty-php/source/browse/trunk/distribution/change_log.txt - http://advisories.mageia.org/MGASA-2014-0468.html - http://secunia.com/advisories/50589 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:221 - http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-000094.html - http://jvn.jp/en/jp/JVN63650108/index.html - http://www.openwall.com/lists/oss-security/2012/09/20/3 - http://www.securityfocus.com/bid/55506 - http://code.google.com/p/smarty-php/source/detail?r=4658
CVE ID: CVE-2012-4438 State: PUBLISHED Published: 2019-11-18T20:46:21 Last Updated: 2024-08-06T20:35:09.455Z Vendors: jenkins Products: jenkins Problem Types: Other Description: Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers with read access and HTTP access to Jenkins master to insert data and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2012-4438 - http://www.openwall.com/lists/oss-security/2012/09/21/2 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4438 - https://www.cloudbees.com/jenkins-security-advisory-2012-09-17
CVE ID: CVE-2012-4439 State: PUBLISHED Published: 2019-11-18T20:56:45 Last Updated: 2024-08-06T20:35:09.695Z Vendors: jenkins Products: jenkins Problem Types: Cross-Site Scripting Description: Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2012-4439 - http://www.openwall.com/lists/oss-security/2012/09/21/2 - https://www.cloudbees.com/jenkins-security-advisory-2012-09-17 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-4439
CVE ID: CVE-2012-4440 State: PUBLISHED Published: 2019-11-18T21:03:04 Last Updated: 2024-08-06T20:35:09.863Z Vendors: jenkins Products: jenkins Problem Types: Cross-Site Scripting Description: Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the Violations plugin. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2012-4440 - http://www.openwall.com/lists/oss-security/2012/09/21/2 - https://www.cloudbees.com/jenkins-security-advisory-2012-09-17
CVE ID: CVE-2012-4441 State: PUBLISHED Published: 2019-11-18T21:07:09 Last Updated: 2024-08-06T20:35:09.854Z Vendors: jenkins Products: jenkins Problem Types: Cross-Site Scripting Description: Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/21/2 - https://security-tracker.debian.org/tracker/CVE-2012-4441 - https://www.cloudbees.com/jenkins-security-advisory-2012-09-17
CVE ID: CVE-2012-4442 State: PUBLISHED Published: 2012-10-05T21:00:00Z Last Updated: 2024-09-17T04:03:42.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monkey HTTP Daemon 0.9.3 retains the supplementary group IDs of the root account during operations with a non-root effective UID, which might allow local users to bypass intended file-read restrictions by leveraging a race condition in a file-permission check. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688879 - http://www.openwall.com/lists/oss-security/2012/09/21/3 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688007
CVE ID: CVE-2012-4443 State: PUBLISHED Published: 2012-10-05T17:00:00Z Last Updated: 2024-09-17T03:59:14.458Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monkey HTTP Daemon 0.9.3 uses a real UID of root and a real GID of root during execution of CGI scripts, which might allow local users to gain privileges by leveraging cgi-bin write access. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688879 - http://www.openwall.com/lists/oss-security/2012/09/21/10 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688008
CVE ID: CVE-2012-4444 State: PUBLISHED Published: 2012-12-21T11:00:00 Last Updated: 2024-08-06T20:35:10.019Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments. Additional Analyst Notes: - CVE Program Container: References: - http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36 - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00000.html - http://rhn.redhat.com/errata/RHSA-2012-1580.html - http://www.openwall.com/lists/oss-security/2012/11/09/2 - https://bugzilla.redhat.com/show_bu
rata/RHSA-2012-1580.html - http://www.openwall.com/lists/oss-security/2012/11/09/2 - https://bugzilla.redhat.com/show_bug.cgi?id=874835 - https://github.com/torvalds/linux/commit/70789d7052239992824628db8133de08dc78e593 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=70789d7052239992824628db8133de08dc78e593 - https://media.blackhat.com/bh-eu-12/Atlasis/bh-eu-12-Atlasis-Attacking_IPv6-WP.pdf - http://www.ubuntu.com/usn/USN-1661-1 - http://www.ubuntu.com/usn/USN-1660-1
CVE ID: CVE-2012-4445 State: PUBLISHED Published: 2012-10-10T18:00:00 Last Updated: 2024-08-06T20:35:09.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set. Additional Analyst Notes: - CVE Program Container: References: - http://w1.fi/gitweb/gitweb.cgi?p=hostap.git%3Ba=commitdiff%3Bh=586c446e0ff42ae00315b014924ec669023bd8de - http://www.pre-cert.de/advisorie
b/gitweb.cgi?p=hostap.git%3Ba=commitdiff%3Bh=586c446e0ff42ae00315b014924ec669023bd8de - http://www.pre-cert.de/advisories/PRE-SA-2012-07.txt - http://www.openwall.com/lists/oss-security/2012/10/08/3 - http://secunia.com/advisories/50805 - http://www.debian.org/security/2012/dsa-2557 - http://www.securitytracker.com/id?1027808 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:168 - http://osvdb.org/86051 - http://www.securityfocus.com/bid/55826 - http://www.freebsd.org/security/advisories/FreeBSD-SA-12:07.hostapd.asc - https://exchange.xforce.ibmcloud.com/vulnerabilities/79104 - http://secunia.com/advisories/50888
CVE ID: CVE-2012-4446 State: PUBLISHED Published: 2013-03-12T15:00:00Z Last Updated: 2024-09-16T18:34:59.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request. Additional Analyst Notes: - CVE Program Container: References: - https://issues.apache.org/jira/browse/QPID-4631 - http://rhn.redhat.com/errata/RHSA-2013-0561.html - http://rhn.redhat.com/errata/RHSA-2013-0562.html - https://bugzilla.redhat.com/show_bug
com/errata/RHSA-2013-0561.html - http://rhn.redhat.com/errata/RHSA-2013-0562.html - https://bugzilla.redhat.com/show_bug.cgi?id=851355 - http://secunia.com/advisories/52516
CVE ID: CVE-2012-4447 State: PUBLISHED Published: 2012-10-28T15:00:00 Last Updated: 2024-08-06T20:35:09.663Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in tif_pixarlog.c in LibTIFF before 4.0.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF image using the PixarLog Compression format. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/51049 - http://www.debian.org/security/2012/dsa-2561 - http://www.openwall.com/lists/oss-security/2012/09/25/9 - http://www.ubuntu.com/usn/USN-1631-1 - http://www.remotesensing.org/libtiff/v4.0.3
com/lists/oss-security/2012/09/25/9 - http://www.ubuntu.com/usn/USN-1631-1 - http://www.remotesensing.org/libtiff/v4.0.3.html - http://secunia.com/advisories/49938 - http://lists.opensuse.org/opensuse-updates/2013-01/msg00076.html - http://www.openwall.com/lists/oss-security/2012/09/25/14 - http://www.securityfocus.com/bid/55673 - http://rhn.redhat.com/errata/RHSA-2012-1590.html - https://bugzilla.redhat.com/show_bug.cgi?id=860198
CVE ID: CVE-2012-4448 State: PUBLISHED Published: 2012-09-28T21:00:00Z Last Updated: 2024-08-06T20:35:09.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.gentoo.org/show_bug.cgi?id=436198 - http://secunia.com/advisories/50715 - http://packetstormsecurity.org/files/116785/WordPress-3.4.2-Cross-Site-Request-Forgery.html - http://openwall.com/lists/oss-security/2012/0
ecurity.org/files/116785/WordPress-3.4.2-Cross-Site-Request-Forgery.html - http://openwall.com/lists/oss-security/2012/09/25/15 - https://bugzilla.redhat.com/show_bug.cgi?id=860261
CVE ID: CVE-2012-4449 State: PUBLISHED Published: 2017-10-30T19:00:00 Last Updated: 2024-08-06T20:35:09.926Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0 - http://mail-archives.apache.org/mod_mbox/hadoop-general/201210.mbox/%3CCA+z3+9FYdPmzBEaMZ71SUqzRx=eU=o4mSH
l#topic_1_0 - http://mail-archives.apache.org/mod_mbox/hadoop-general/201210.mbox/%3CCA+z3+9FYdPmzBEaMZ71SUqzRx=eU=o4mSHUsbrpzgR9X_F1c0Q%40mail.gmail.com%3E
CVE ID: CVE-2012-4450 State: PUBLISHED Published: 2012-10-01T01:00:00 Last Updated: 2024-08-06T20:35:09.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: 389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=860772 - https://fedorahosted.org/389/ticket/340 - http://git.fedorahosted.org/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09 - http://secunia.com/advisories/50713 - http://rhn
g/cgit/389/ds.git/commit/?id=5beb93d42efb807838c09c5fab898876876f8d09 - http://secunia.com/advisories/50713 - http://rhn.redhat.com/errata/RHSA-2013-0503.html - http://www.openwall.com/lists/oss-security/2012/09/26/3 - http://www.openwall.com/lists/oss-security/2012/09/26/5 - http://www.securityfocus.com/bid/55690
CVE ID: CVE-2012-4451 State: PUBLISHED Published: 2020-01-03T16:03:03 Last Updated: 2024-08-06T20:35:09.764Z Vendors: Zend Technologies Products: Zend Framework Problem Types: Cross-Site Scripting Description: Multiple cross-site scripting (XSS) vulnerabilities in Zend Framework 2.0.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) Debug, (2) Feed\PubSubHubbub, (3) Log\Formatter\Xml, (4) Tag\Cloud\Decorator, (5) Uri, (6) View\Helper\HeadStyle, (7) View\Helper\Navigation\Sitemap, or (8) View\Helper\Placeholder\Container\AbstractStandalone, related to Escaper. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.d
\AbstractStandalone, related to Escaper. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=688946#10 - https://bugs.gentoo.org/show_bug.cgi?id=436210 - http://seclists.org/oss-sec/2012/q3/571 - http://seclists.org/oss-sec/2012/q3/573 - http://framework.zend.com/security/advisory/ZF2012-03 - https://bugzilla.redhat.com/show_bug.cgi?id=860738 - https://github.com/zendframework/zf2/commit/27131ca9520bdf1d4c774c71459eba32f2b10733 - http://www.securityfocus.com/bid/55636
CVE ID: CVE-2012-4452 State: PUBLISHED Published: 2012-10-09T23:00:00 Last Updated: 2024-08-06T20:35:09.953Z Vendors: n/a Products: n/a Problem Types: n/a Description: MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vu
he MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/55715 - https://bugzilla.redhat.com/show_bug.cgi?id=860808 - http://rhn.redhat.com/errata/RHSA-2013-0121.html - http://www.openwall.com/lists/oss-security/2012/09/27/1
CVE ID: CVE-2012-4453 State: PUBLISHED Published: 2012-10-09T23:00:00 Last Updated: 2024-08-06T20:35:09.839Z Vendors: n/a Products: n/a Problem Types: n/a Description: dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-1674.html - https://bugzilla.redhat.com/show_bug.cgi?id=859448 - http://www.securityfocus.com/bid/55713 - http://www.openwall.com/lists/oss-security/2012/09/27/4 - https://exchange.xforce.ibmcloud.com
rityfocus.com/bid/55713 - http://www.openwall.com/lists/oss-security/2012/09/27/4 - https://exchange.xforce.ibmcloud.com/vulnerabilities/79258 - http://git.kernel.org/?p=boot/dracut/dracut.git%3Ba=commit%3Bh=e1b48995c26c4f06d1a71 - http://www.openwall.com/lists/oss-security/2012/09/27/6 - http://www.openwall.com/lists/oss-security/2012/09/27/3
CVE ID: CVE-2012-4454 State: PUBLISHED Published: 2012-10-10T18:00:00 Last Updated: 2024-08-06T20:35:09.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/09/2 - http://www.openwall.com/lists/oss-security/2012/09/25/5 - http://secunia.com/advisories/50702 - http://www.securityfocus.com/bid/55627 - http://www.openwall.com/lists/oss-security/2012/09/27/2 - http
visories/50702 - http://www.securityfocus.com/bid/55627 - http://www.openwall.com/lists/oss-security/2012/09/27/2 - http://sourceforge.net/mailarchive/message.php?msg_id=28878345 - http://www.openwall.com/lists/oss-security/2012/09/20/6 - https://bugzilla.redhat.com/show_bug.cgi?id=730636 - https://exchange.xforce.ibmcloud.com/vulnerabilities/78797 - http://www.openwall.com/lists/oss-security/2012/09/07/2 - http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=b7fcb3eb0319183348f1f4fb90ede4edd6487c30 - http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9 -
sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=58345488c9351d9be9a4be27c8b407c2706a33a9 - http://www.openwall.com/lists/oss-security/2012/09/07/6
CVE ID: CVE-2012-4455 State: PUBLISHED Published: 2012-10-10T18:00:00 Last Updated: 2024-08-06T20:35:09.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/09/2 - http://www.openwall.com/lists/oss-security/2012/09/25/5 - http://secunia.com/advisories/50702 - http://www.securityfocus.com/bid/55627 - http://www.openwall.com/lists/oss-security/2012/09/27/2 - https://exch
/50702 - http://www.securityfocus.com/bid/55627 - http://www.openwall.com/lists/oss-security/2012/09/27/2 - https://exchange.xforce.ibmcloud.com/vulnerabilities/78943 - http://www.openwall.com/lists/oss-security/2012/09/20/6 - https://bugzilla.redhat.com/show_bug.cgi?id=730636 - http://sourceforge.net/mailarchive/message.php?msg_id=29191022 - http://opencryptoki.git.sourceforge.net/git/gitweb.cgi?p=opencryptoki/opencryptoki%3Ba=commitdiff%3Bh=5667edb52cd27b7e512f48f823b4bcc6b872ab15 - http://www.openwall.com/lists/oss-security/2012/09/07/2 - http://www.openwall.com/lists/oss-security/2012/09/07/6
CVE ID: CVE-2012-4456 State: PUBLISHED Published: 2012-10-09T15:00:00 Last Updated: 2024-08-06T20:35:09.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/09/28/5 - http://secunia.com/advisories/50665 - https://lists.launchpad.net/openstack/msg17034.html - https://github.com/openstack/keystone/commit/2
/advisories/50665 - https://lists.launchpad.net/openstack/msg17034.html - https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431 - https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1 - https://bugs.launchpad.net/keystone/+bug/1006822 - http://www.securityfocus.com/bid/55716 - https://bugs.launchpad.net/keystone/+bug/1006815 - https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb - https://exchange.xforce.ibmcloud.com/vulnerabilities/78944 - https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb - https://bugzilla.redhat.com/show_bug.cgi?id=861179
CVE ID: CVE-2012-4457 State: PUBLISHED Published: 2012-10-09T15:00:00 Last Updated: 2024-08-06T20:35:09.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/50665 - https://bugzilla.redhat.com/show_bug.cgi?id=861180 - https://lists.launchpad.net/openstack/msg17035.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/78947 - http://www.ope
ists.launchpad.net/openstack/msg17035.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/78947 - http://www.openwall.com/lists/oss-security/2012/09/28/6 - http://www.securityfocus.com/bid/55716 - https://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5 - https://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685