Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-17805 State: PUBLISHED Published: 2017-12-20T23:00:00 Last Updated: 2024-08-05T20:59:17.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Sals
th the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2018:3083 - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ubuntu.com/3617-3/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://usn.ubuntu.com/3632-1/ - https://usn.ubuntu.com/3620-2/ - http://l
use-security-announce/2018-01/msg00007.html - https://usn.ubuntu.com/3632-1/ - https://usn.ubuntu.com/3620-2/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html - http://www.securityfocus.com/bid/102291 - https://access.redhat.com/errata/RHSA-2018:2948 - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8 - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html - https://www.debian.org/security/2017/dsa-4073 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ecaaab5649781c5a0effdaf298a925063020500e - https://usn.ubuntu.com/3617-2/ - https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500
500e - https://usn.ubuntu.com/3617-2/ - https://github.com/torvalds/linux/commit/ecaaab5649781c5a0effdaf298a925063020500e - https://usn.ubuntu.com/3620-1/ - https://access.redhat.com/errata/RHSA-2018:3096 - https://usn.ubuntu.com/3619-1/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html - https://access.redhat.com/errata/RHSA-2019:2473
CVE ID: CVE-2017-17806 State: PUBLISHED Published: 2017-12-20T23:00:00 Last Updated: 2024-08-05T20:59:17.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3617-
sing SHA-3 initialization. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ubuntu.com/3617-3/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00008.html - https://usn.ubuntu.com/3583-2/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html - https://github.com/torvalds/linux/commit/af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 - https://usn.ubuntu.com/3632-1/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html - http://www.
ttps://usn.ubuntu.com/3632-1/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00014.html - http://www.securityfocus.com/bid/102293 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1 - https://access.redhat.com/errata/RHSA-2018:2948 - https://usn.ubuntu.com/3583-1/ - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8 - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00006.html - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3617-2/ - https://usn.ubuntu.com/3619-1/ - http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00016.html
CVE ID: CVE-2017-17807 State: PUBLISHED Published: 2017-12-20T23:00:00 Last Updated: 2024-08-05T20:59:17.864Z Vendors: n/a Products: n/a Problem Types: n/a Description: The KEYS subsystem in the Linux kernel before 4.14.6 omitted an access-control check when adding a key to the current task's "default request-key keyring" via the request_key() system call, allowing a local user to use a sequence of crafted system calls to add keys to a keyring with only Search permission (not Write permission) to that keyring, related to construct_get_dest_keyring() in security/keys/request_key.c. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/tor
_key.c. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4dca6ea1d9432052afb06baf2e3ae78188a4410b - http://www.securityfocus.com/bid/102301 - https://usn.ubuntu.com/3617-1/ - https://usn.ubuntu.com/3619-2/ - https://www.debian.org/security/2018/dsa-4082 - https://usn.ubuntu.com/3617-3/ - https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html - https://usn.ubuntu.com/3632-1/ - https://usn.ubuntu.com/3620-2/ - https://github.com/torvalds/linux/commit/4dca6ea1d9432052afb06baf2e3ae78188a4410b - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3617-2/ - https://www.kernel.or
e3ae78188a4410b - https://www.debian.org/security/2017/dsa-4073 - https://usn.ubuntu.com/3617-2/ - https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.6 - https://usn.ubuntu.com/3620-1/ - https://usn.ubuntu.com/3619-1/
CVE ID: CVE-2017-17809 State: PUBLISHED Published: 2017-12-20T23:00:00Z Last Updated: 2024-09-16T23:00:31.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Golden Frog VyprVPN before 2.15.0.5828 for macOS, the vyprvpnservice launch daemon has an unprotected XPC service that allows attackers to update the underlying OpenVPN configuration and the arguments passed to the OpenVPN binary when executed. An attacker can abuse this vulnerability by forcing the VyprVPN application to load a malicious dynamic library every time a new connection is made. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2017
alyst Notes: - CVE Program Container: References: - https://github.com/VerSprite/research/blob/master/advisories/VS-2017-007.md
CVE ID: CVE-2017-17810 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a "SEGV on unknown address" that will cause a remote denial of service attack, because asm/preproc.c mishandles macro calls that have the wrong number of arguments. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392431 - http://repo.or.cz/nasm.git/commit/59ce1c67b16967c652765e62aa130b7e43f21dd4 - https://usn.ubuntu.com/3694-1/
CVE ID: CVE-2017-17811 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:18.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer overflow that will cause a remote denial of service attack, related to a strcpy in paste_tokens in asm/preproc.c, a similar issue to CVE-2017-11111. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392432 - https://usn.ubuntu.com/3694-1/
CVE ID: CVE-2017-17812 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read in the function detoken() in asm/preproc.c that will cause a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392424 - https://usn.ubuntu.com/3694-1/ - http://repo.or.cz/nasm.git/commit/9b7ee09abfd426b99aa1ea81d19a3b2818eeabf9
CVE ID: CVE-2017-17813 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.919Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in the pp_list_one_macro function in asm/preproc.c that will cause a remote denial of service attack, related to mishandling of line-syntax errors. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392429 - https://usn.ubuntu.com/3694-1/
CVE ID: CVE-2017-17814 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in do_directive in asm/preproc.c that will cause a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392430 - https://usn.ubuntu.com/3694-1/
CVE ID: CVE-2017-17815 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause a remote denial of service attack, because of a missing check for the relationship between minimum and maximum parameter counts. Additional Analyst Notes: - CVE Program Container: References: - http://repo.or.cz/nasm.git/commit/c9244eaadd05b27637cde06021bac3fa1d920aa3 - https://usn.ubuntu.com/3694-1/ - https://bugzilla.nasm.us/show_bug.cgi?id=3392436
CVE ID: CVE-2017-17816 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_getline in asm/preproc.c that will cause a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392426 - https://usn.ubuntu.com/3694-1/
CVE ID: CVE-2017-17817 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_verror in asm/preproc.c that will cause a remote denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3694-1/ - https://bugzilla.nasm.us/show_bug.cgi?id=3392427
CVE ID: CVE-2017-17818 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste_tokens in asm/preproc.c. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3694-1/ - https://bugzilla.nasm.us/show_bug.cgi?id=3392428
CVE ID: CVE-2017-17819 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:18.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that will cause a remote denial of service attack, because pointers associated with skip_white_ calls are not validated. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.nasm.us/show_bug.cgi?id=3392435 - https://usn.ubuntu.com/3694-1/ - http://repo.or.cz/nasm.git/commit/7524cfd91492e6e3719b959498be584a9ced13af
CVE ID: CVE-2017-17820 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:17.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Netwide Assembler (NASM) 2.14rc0, there is a use-after-free in pp_list_one_macro in asm/preproc.c that will lead to a remote denial of service attack, related to mishandling of operand-type errors. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3694-1/ - https://bugzilla.nasm.us/show_bug.cgi?id=3392433
CVE ID: CVE-2017-17821 State: PUBLISHED Published: 2017-12-21T03:00:00 Last Updated: 2024-08-05T20:59:18.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: WTF/wtf/FastBitVector.h in WebKit, as distributed in Safari Technology Preview Release 46, allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact because it calls the FastBitVectorWordOwner::resizeSlow function (in WTF/wtf/FastBitVector.cpp) for a purpose other than initializing a bitvector size, and resizeSlow mishandles cases where the old array length is greater than the new array length. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.
gth is greater than the new array length. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.webkit.org/show_bug.cgi?id=181020 - https://github.com/dwfault/PoCs/blob/master/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF/WebKit%20Misuse%20of%20WTF:wtf:FastBitVector%20result%20in%20potential%20BOF.md
CVE ID: CVE-2017-17822 State: PUBLISHED Published: 2017-12-21T04:00:00 Last Updated: 2024-08-05T20:59:17.958Z Vendors: n/a Products: n/a Problem Types: n/a Description: The List Users API of Piwigo 2.9.2 is vulnerable to SQL Injection via the /admin/user_list_backend.php sSortDir_0 parameter. An attacker can exploit this to gain access to the data in a connected MySQL database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md - https://github.com/Piwigo/Piwigo/commit/33a03e9afb8fb00c9d8f480424d549311fe03d40 - https://
s%20in%20Piwigo%202.9.2.md - https://github.com/Piwigo/Piwigo/commit/33a03e9afb8fb00c9d8f480424d549311fe03d40 - https://github.com/Piwigo/Piwigo/issues/823
CVE ID: CVE-2017-17823 State: PUBLISHED Published: 2017-12-21T04:00:00 Last Updated: 2024-08-05T20:59:17.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Configuration component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/configuration.php order_by array parameter. An attacker can exploit this to gain access to the data in a connected MySQL database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/826 - https://github.com/Piwigo/Piwigo/commit/91ef7909a5c51203f330cbecf986472900b60983 - https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection
- https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE ID: CVE-2017-17824 State: PUBLISHED Published: 2017-12-21T04:00:00 Last Updated: 2024-08-05T20:59:17.997Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Batch Manager component of Piwigo 2.9.2 is vulnerable to SQL Injection via the admin/batch_manager_unit.php element_ids parameter in unit mode. An attacker can exploit this to gain access to the data in a connected MySQL database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Multiple%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo%202.9.2.md - https://github.com/Piwigo/Piwigo/commit/f7c8e0a947a857ff5d31dafd0384
ection%20Vulnerabilities%20in%20Piwigo%202.9.2.md - https://github.com/Piwigo/Piwigo/commit/f7c8e0a947a857ff5d31dafd03842df41959b84c - https://github.com/Piwigo/Piwigo/issues/825
CVE ID: CVE-2017-17825 State: PUBLISHED Published: 2017-12-21T04:00:00 Last Updated: 2024-08-05T20:59:17.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Batch Manager component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via tags-* array parameters in an admin.php?page=batch_manager&mode=unit request. An attacker can exploit this to hijack a client's browser along with the data stored in it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE ID: CVE-2017-17826 State: PUBLISHED Published: 2017-12-21T04:00:00 Last Updated: 2024-08-05T20:59:18.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Configuration component of Piwigo 2.9.2 is vulnerable to Persistent Cross Site Scripting via the gallery_title parameter in an admin.php?page=configuration&section=main request. An attacker can exploit this to hijack a client's browser along with the data stored in it. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Stored%20XSS%20Vulnerabilities%20in%20Piwigo%202.9.2.md
CVE ID: CVE-2017-17827 State: PUBLISHED Published: 2017-12-21T04:00:00 Last Updated: 2024-08-05T20:59:17.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batch_manager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Piwigo/Piwigo/issues/822 - https://github.com/Piwigo/Piwigo/commit/c3b4c6f7f0ddeaea492080fb8211d7b4cfedaf6f - https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Cross%20S
b8211d7b4cfedaf6f - https://github.com/sahildhar/sahildhar.github.io/blob/master/research/reports/Piwigo_2.9.2/Cross%20Site%20Request%20Forgery%20in%20Piwigo%202.9.2.md
CVE ID: CVE-2017-17828 State: PUBLISHED Published: 2017-12-21T05:00:00Z Last Updated: 2024-09-17T04:20:15.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md
CVE ID: CVE-2017-17829 State: PUBLISHED Published: 2017-12-21T05:00:00Z Last Updated: 2024-09-17T01:31:00.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bus Booking Script has SQL Injection via the admin/view_seatseller.php sp_id parameter or the admin/view_member.php memid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md
CVE ID: CVE-2017-17830 State: PUBLISHED Published: 2017-12-21T05:00:00Z Last Updated: 2024-09-16T16:53:31.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bus Booking Script has CSRF via admin/new_master.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/d4wner/Vulnerabilities-Report/blob/master/Bus-Booking-Script.md
CVE ID: CVE-2017-17831 State: PUBLISHED Published: 2017-12-21T06:00:00 Last Updated: 2024-08-05T21:06:48.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a "url =" line in a .lfsconfig file within a repository. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/git-lfs/git-lfs/releases/tag/v2.1.1 - http://blog.recurity-labs.com/2017-08-10/scm-vulns - http://www.securityfocus.com/bid/102926 - https://github.com/git-lfs/git-lfs/pull/2242 - https://confluence.atlassian.com/sourcetreekb/sourcetr
s.com/bid/102926 - https://github.com/git-lfs/git-lfs/pull/2242 - https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
CVE ID: CVE-2017-17832 State: PUBLISHED Published: 2017-12-22T18:00:00 Last Updated: 2024-08-05T21:06:48.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServersCheck Monitoring Software before 14.2.3 is prone to a cross-site scripting vulnerability as user supplied-data is not validated/sanitized when passed in the settings_SMS_ALERT_TYPE parameter, and JavaScript can be executed on settings-save.html (the Settings - SMS Alerts page). Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/145517/ServersCheck-Monitoring-Software-Cross-Site-Scripting.html - https://serverscheck.com/monitoring-software/release.asp
CVE ID: CVE-2017-17833 State: PUBLISHED Published: 2018-04-23T18:00:00 Last Updated: 2024-08-05T21:06:48.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3708-1/ - https://sourceforge.net/p/openslp/mercurial/ci/151f07745901cbdba6e00e4889561b4083250da1/ - https://lists.debian.org/debian-lts-announce/2018/04/msg00029.html - http://support.lenovo.com/us/en/solutions/LEN-18247 - https://access.redhat.com/errat
s-announce/2018/04/msg00029.html - http://support.lenovo.com/us/en/solutions/LEN-18247 - https://access.redhat.com/errata/RHSA-2018:2308 - https://access.redhat.com/errata/RHSA-2018:2240 - https://security.gentoo.org/glsa/202005-12
CVE ID: CVE-2017-17834 State: REJECTED Published: 2019-02-07T23:00:00 Last Updated: 2019-02-07T22:57:01 Description: No description available.
CVE ID: CVE-2017-17835 State: PUBLISHED Published: 2019-01-23T17:00:00Z Last Updated: 2024-09-16T17:08:32.151Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Cross-Site Request Forgery Description: In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E
CVE ID: CVE-2017-17836 State: PUBLISHED Published: 2019-01-23T17:00:00Z Last Updated: 2024-09-17T02:27:27.150Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: Information Exposure Description: In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.
ences: - https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E