Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-5690 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.095Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter (aka the page limit number). Additional Analyst Notes: - CVE Program Container: References: - https://hg.dotclear.org/dotclear/rev/3b0b868d58b0 - http://dev.dotclear.org/2.0/changeset/3b0b868d58b00a1b216e0dc13c461bb3550ed3da
CVE ID: CVE-2018-5691 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.146Z Vendors: n/a Products: n/a Problem Types: n/a Description: SonicWall Global Management System (GMS) 8.1 has XSS via the `newName` and `Name` values of the `/sgms/TreeControl` module. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=1819 - http://documents.software.dell.com/sonicwall-gms-os/8.2/release-notes/known-issues?ParentProduct=867 - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0003
CVE ID: CVE-2018-5692 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo v2.8.2 has XSS via the `tab`, `to`, `section`, `mode`, `installstatus`, and `display` parameters of the `admin.php` file. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2005
CVE ID: CVE-2018-5693 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog. Additional Analyst Notes: - CVE Program Container: References: - http://forums.wizard.ca/viewtopic.php?f=17&t=236760 - https://www.vulnerability-lab.com/get_content.php?id=2113
CVE ID: CVE-2018-5694 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: The callforward module in User Control Panel (UCP) in Nicolas Gudino (aka Asternic) Flash Operator Panel (FOP) 2.31.03 allows remote authenticated users to execute arbitrary commands via the command parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=1907
CVE ID: CVE-2018-5695 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=1940
CVE ID: CVE-2018-5696 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: The iJoomla com_adagency plugin 6.0.9 for Joomla! allows SQL injection via the `advertiser_status` and `status_select` parameters to index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=1927
CVE ID: CVE-2018-5697 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Icy Phoenix 2.2.0.105 allows SQL injection via an unapprove request to admin_kb_art.php or the order parameter to admin_jr_admin.php, related to functions_kb.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.vulnerability-lab.com/get_content.php?id=2006
CVE ID: CVE-2018-5698 State: PUBLISHED Published: 2018-01-14T04:00:00 Last Updated: 2024-08-05T05:40:51.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: libreadstat.a in WizardMac ReadStat 0.1.1 has a heap-based buffer over-read via an unterminated string. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/WizardMac/ReadStat/issues/108
CVE ID: CVE-2018-5700 State: PUBLISHED Published: 2018-01-14T20:00:00 Last Updated: 2024-08-05T05:40:51.214Z Vendors: n/a Products: n/a Problem Types: n/a Description: Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/class.ftpfolder.php) to move a .php file from the FTP folder into a web folder. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xWfox/Winmail/blob/master/Winmail_6.2.md
CVE ID: CVE-2018-5701 State: PUBLISHED Published: 2018-01-31T18:00:00 Last Updated: 2024-08-05T05:40:51.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Iolo System Shield AntiVirus and AntiSpyware 5.0.0.136, the amp.sys driver file contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x00226003. Additional Analyst Notes: - CVE Program Container: References: - https://www.greyhathacker.net/?p=1006 - http://packetstormsecurity.com/files/146165/System-Shield-5.0.0.136-Privilege-Escalation.html - https://www.exploit-db.com/exploits/43929/
CVE ID: CVE-2018-5702 State: PUBLISHED Published: 2018-01-15T16:00:00 Last Updated: 2024-08-05T05:40:51.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.chromium.org/p/project-zero/issues/detail?id=1447 - https://www.exploit-db.com/exploits/43665/ - https://www.debian.org/security/2018/dsa
oject-zero/issues/detail?id=1447 - https://www.exploit-db.com/exploits/43665/ - https://www.debian.org/security/2018/dsa-4087 - https://github.com/transmission/transmission/pull/468 - https://security.gentoo.org/glsa/201806-07 - https://twitter.com/taviso/status/951526615145566208 - https://lists.debian.org/debian-lts-announce/2018/01/msg00020.html
CVE ID: CVE-2018-5703 State: PUBLISHED Published: 2018-01-16T09:00:00 Last Updated: 2024-08-05T05:40:51.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause a denial of service (slab out-of-bounds write) or possibly have unspecified other impact via vectors involving TLS. Additional Analyst Notes: - CVE Program Container: References: - https://groups.google.com/d/msg/syzkaller-bugs/0PBeVnSzfqQ/5eXAlM46BQAJ
CVE ID: CVE-2018-5704 State: PUBLISHED Published: 2018-01-16T09:00:00 Last Updated: 2024-08-05T05:40:51.240Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands, via a crafted web site. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/openocd/mailman/message/36188041/ - https://www.debian.org/security/2018/dsa-4093 - https://lists.debian.org/debian-lts-announce/2018/01/msg00027.html
CVE ID: CVE-2018-5705 State: PUBLISHED Published: 2018-01-24T17:00:00 Last Updated: 2024-08-05T05:40:51.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to the /search URI). Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL, code will be executed. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145940/Reservo-Image-Hosting-Script-1.5-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/43676/
CVE ID: CVE-2018-5706 State: PUBLISHED Published: 2018-01-16T10:00:00 Last Updated: 2024-08-05T05:40:51.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Octopus Deploy before 4.1.9. Any user with user editing permissions can modify teams to give themselves Administer System permissions even if they didn't have them, as demonstrated by use of the RoleEdit or TeamEdit permission. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OctopusDeploy/Issues/issues/4167
CVE ID: CVE-2018-5708 State: PUBLISHED Published: 2018-03-30T21:00:00 Last Updated: 2024-08-05T05:40:51.189Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response (specifically, the configuration file restore_default), which is displayed in XML. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44388/ - http://seclists.org/fulldisclosure/2018/Mar/66 - https://securityadvisories.dlink.com/announcement/publicatio
s/44388/ - http://seclists.org/fulldisclosure/2018/Mar/66 - https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10111
CVE ID: CVE-2018-5709 State: PUBLISHED Published: 2018-01-16T09:00:00 Last Updated: 2024-08-05T05:40:51.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tre
Analyst Notes: - CVE Program Container: References: - https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow - https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
CVE ID: CVE-2018-5710 State: PUBLISHED Published: 2018-01-16T09:00:00 Last Updated: 2024-08-05T05:40:51.143Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29
CVE ID: CVE-2018-5711 State: PUBLISHED Published: 2018-01-16T09:00:00 Last Updated: 2024-08-05T05:40:51.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the imagecreatefromgif or imagecreatefromstring PHP function. This is related to GetCode_ and gdImageCreateFromGifCtx. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.php.net/bug.php?id=75571 - https://usn.ubuntu.com/3755-1/ - https://acc
VE Program Container: References: - https://bugs.php.net/bug.php?id=75571 - https://usn.ubuntu.com/3755-1/ - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://lists.debian.org/debian-lts-announce/2019/01/msg00028.html - http://php.net/ChangeLog-7.php - https://lists.debian.org/debian-lts-announce/2018/01/msg00022.html - https://security.gentoo.org/glsa/201903-18 - https://access.redhat.com/errata/RHSA-2019:2519 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/ - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-5712 State: PUBLISHED Published: 2018-01-16T09:00:00 Last Updated: 2024-08-05T05:40:51.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3600-1/ - http://www.securitytracker.com/id/1040363 - http://www.securityfocus.com/bid/104020 - https://access.redhat.com/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://usn.ubuntu.com/3566-1/ - http://php.net/ChangeLog-7.
om/errata/RHSA-2018:1296 - http://php.net/ChangeLog-5.php - https://usn.ubuntu.com/3566-1/ - http://php.net/ChangeLog-7.php - https://lists.debian.org/debian-lts-announce/2018/01/msg00025.html - https://bugs.php.net/bug.php?id=74782 - http://www.securityfocus.com/bid/102742 - https://usn.ubuntu.com/3600-2/ - https://access.redhat.com/errata/RHSA-2019:2519 - https://www.oracle.com/security-alerts/cpuapr2020.html
CVE ID: CVE-2018-5713 State: PUBLISHED Published: 2018-01-16T19:00:00Z Last Updated: 2024-09-16T20:11:41.833Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002010. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whiteHat001/DRIVER_POC/tree/master/malwarefox/0x80002010
CVE ID: CVE-2018-5714 State: PUBLISHED Published: 2018-01-16T19:00:00Z Last Updated: 2024-09-17T00:42:35.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.sys) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0x80002054. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/whiteHat001/DRIVER_POC/tree/master/malwarefox/0x80002054
CVE ID: CVE-2018-5715 State: PUBLISHED Published: 2018-01-16T20:00:00 Last Updated: 2024-08-05T05:40:51.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable). Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43683/ - https://m4k4br0.github.io/sugarcrm-xss/
CVE ID: CVE-2018-5716 State: PUBLISHED Published: 2018-02-21T15:00:00 Last Updated: 2024-08-05T05:40:51.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter "lf" to the goform/edit_lf_get_data URI, the attacker can retrieve the content of a file. Additional Analyst Notes: - CVE Program Container: References: - http://www.0x90.zone/web/path-traversal/2018/02/16/Path-Traversal-Reprise-LM.html
CVE ID: CVE-2018-5717 State: PUBLISHED Published: 2018-03-20T14:00:00 Last Updated: 2024-08-05T05:40:51.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: Memory write mechanism in NCR S2 Dispenser controller before firmware version 0x0108 allows an unauthenticated user to upgrade or downgrade the firmware of the device, including to older versions with known vulnerabilities. Additional Analyst Notes: - CVE Program Container: References: - https://www.ncr.com/sites/default/files/ncr_security_alert_-_2018-04_v3.pdf
CVE ID: CVE-2018-5718 State: PUBLISHED Published: 2018-06-12T16:00:00 Last Updated: 2024-08-05T05:40:51.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper restriction of write operations within the bounds of a memory buffer in snscore.sys in SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, SoftControl/SafenSoft Enterprise Suite before version 4.4.1 allows local users to cause a denial of service (BSOD) or modify kernel-mode memory via loading of a forged DLL into an user-mode process. Additional Analyst Notes: - CVE Program Container: References: - http://www.safensoft.com/security.phtml?c=865
CVE ID: CVE-2018-5720 State: PUBLISHED Published: 2018-01-29T05:00:00 Last Updated: 2024-08-05T05:40:51.201Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on DODOCOOL DC38 3-in-1 N300 Mini Wireless Range Extend RTN2-AW.GD.R3465.1.20161103 devices. A Cross-site request forgery (CSRF) vulnerability allows remote attackers to hijack the authentication of users for requests that modify all the settings. This vulnerability can lead to changing an existing user's username and password, changing the Wi-Fi password, etc. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43898/
CVE ID: CVE-2018-5721 State: PUBLISHED Published: 2018-01-17T06:00:00 Last Updated: 2024-08-05T05:40:51.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the ej_update_variables function in router/httpd/web.c on ASUS routers (when using software from https://github.com/RMerl/asuswrt-merlin) allows web authenticated attackers to execute code via a request that updates a setting. In ej_update_variables, the length of the variable action_script is not checked, as long as it includes a "_wan_if" substring. Additional Analyst Notes: - CVE Program Container: References: - http://www.w0lfzhang.com/2018/01/17/ASUS-router-stack-overflow-in-http-server/
CVE ID: CVE-2018-5723 State: PUBLISHED Published: 2018-01-16T22:00:00 Last Updated: 2024-08-05T05:40:51.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: MASTER IPCAMERA01 3.3.4.2103 devices have a hardcoded password of cat1029 for the root account. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43693/ - http://syrion.me/blog/master-ipcam/ - https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html
CVE ID: CVE-2018-5724 State: PUBLISHED Published: 2018-01-16T22:00:00 Last Updated: 2024-08-05T05:40:51.242Z Vendors: n/a Products: n/a Problem Types: n/a Description: MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Download and Upload, as demonstrated by restore.cgi. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43693/ - http://syrion.me/blog/master-ipcam/ - https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html
CVE ID: CVE-2018-5725 State: PUBLISHED Published: 2018-01-16T22:00:00 Last Updated: 2024-08-05T05:40:51.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: MASTER IPCAMERA01 3.3.4.2103 devices allow Unauthenticated Configuration Change, as demonstrated by the port number of the web server. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43693/ - http://syrion.me/blog/master-ipcam/ - https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html
CVE ID: CVE-2018-5726 State: PUBLISHED Published: 2018-01-16T22:00:00 Last Updated: 2024-08-05T05:40:51.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: MASTER IPCAMERA01 3.3.4.2103 devices allow remote attackers to obtain sensitive information via a crafted HTTP request, as demonstrated by the username, password, and configuration settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/43693/ - http://syrion.me/blog/master-ipcam/ - https://packetstormsecurity.com/files/145935/Master-IP-CAM-01-Hardcoded-Password-Unauthenticated-Access.html
CVE ID: CVE-2018-5727 State: PUBLISHED Published: 2018-01-16T22:00:00 Last Updated: 2024-08-05T05:40:51.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/uclouvain/openjpeg/issues/1053
CVE ID: CVE-2018-5728 State: PUBLISHED Published: 2018-01-16T23:00:00Z Last Updated: 2024-09-16T17:34:20.784Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information via a /cgi-bin/getSysStatus request, as demonstrated by the Latitude/Longitude of the ship, or satellite details. Additional Analyst Notes: - CVE Program Container: References: - http://misteralfa-hack.blogspot.cl/2018/01/seatelcobham-donde-esta-mi-barco.html
CVE ID: CVE-2018-5729 State: PUBLISHED Published: 2018-03-06T20:00:00 Last Updated: 2024-08-05T05:40:51.270Z Vendors: n/a Products: n/a Problem Types: n/a Description: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1042071 - https://bugzilla.redhat.com/show_bug.cgi?id=1551083 - https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1 - https://access.redhat
ug.cgi?id=1551083 - https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1 - https://access.redhat.com/errata/RHSA-2018:3071 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OIFUL3CPM4S5TOXTTOCQ3CUZN6XCXUTR/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GK5T6JPMBHBPKS7HNGHYUUF4KKRMNSNU/ - https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html - https://access.redhat.com/errata/RHBA-2019:0327 - https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html
CVE ID: CVE-2018-5730 State: PUBLISHED Published: 2018-03-06T20:00:00 Last Updated: 2024-08-05T05:40:51.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1042071 - https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed713