Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-2606 State: PUBLISHED Published: 2018-05-08T20:00:00 Last Updated: 2024-08-05T14:02:06.482Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: unspecified Products: jenkins Problem Types: CWE-200 Description: Jenkins before versions 2.44, 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - https://bugz
al Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2606 - https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51266b63719 - http://www.securityfocus.com/bid/95962
CVE ID: CVE-2017-2607 State: PUBLISHED Published: 2018-05-21T23:00:00 Last Updated: 2024-08-05T14:02:06.917Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-79 Description: jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scr
, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95963 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2607
CVE ID: CVE-2017-2608 State: PUBLISHED Published: 2018-05-15T20:00:00 Last Updated: 2024-08-05T14:02:06.498Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-502 Description: Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - http://www.securityfocus.com/bid/95953 - https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc129cf70722 - https://b
tyfocus.com/bid/95953 - https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc129cf70722 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2608
CVE ID: CVE-2017-2609 State: PUBLISHED Published: 2018-05-22T17:00:00 Last Updated: 2024-08-05T14:02:07.010Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-200 Description: jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/95964 - https://github.com/jenkinsci/jenkins/com
- CVE Program Container: References: - http://www.securityfocus.com/bid/95964 - https://github.com/jenkinsci/jenkins/commit/13905d8224899ba7332fe9af4e330ea96a2ae319 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2609
CVE ID: CVE-2017-2610 State: PUBLISHED Published: 2018-05-15T21:00:00 Last Updated: 2024-08-05T14:02:06.521Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-79 Description: jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - http://www.securityfocus.com/bid/95951 - https://github.com/jenkinsci/jenkins/commit/307ed31caba68a46426b8c73a787a
01/ - http://www.securityfocus.com/bid/95951 - https://github.com/jenkinsci/jenkins/commit/307ed31caba68a46426b8c73a787a05add2c7489 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2610
CVE ID: CVE-2017-2611 State: PUBLISHED Published: 2018-05-08T18:00:00 Last Updated: 2024-08-05T14:02:06.500Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: unspecified Products: jenkins Problem Types: CWE-358 Description: Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents. Additional Analyst Notes: - CVE Program Container
daily), possibly causing additional load on Jenkins master and agents. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - http://www.securityfocus.com/bid/95956 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611 - https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86
CVE ID: CVE-2017-2612 State: PUBLISHED Published: 2018-05-15T20:00:00 Last Updated: 2024-08-05T14:02:06.508Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-358 Description: In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - https://github.com/jenkinsci/jenkins/commit/a814154695e23dc37542af7d40cacc129cf70722 - http://www.securityfocus.com/bid/95957 - https://bugzill
insci/jenkins/commit/a814154695e23dc37542af7d40cacc129cf70722 - http://www.securityfocus.com/bid/95957 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2612
CVE ID: CVE-2017-2613 State: PUBLISHED Published: 2018-05-15T22:00:00 Last Updated: 2024-08-05T14:02:07.012Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: [UNKNOWN] Products: jenkins Problem Types: CWE-770 Description: jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406). Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-02-01/ - https://github.com/jenkinsci/jenkins/commit/b88b20ec4732
eferences: - https://jenkins.io/security/advisory/2017-02-01/ - https://github.com/jenkinsci/jenkins/commit/b88b20ec473200db35d0a0d29dcf192069106601 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2613 - http://www.securityfocus.com/bid/95967
CVE ID: CVE-2017-2614 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:06.983Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: Red Hat Products: ovirt-engine-extension-aaa-jdbc Problem Types: CWE-20 Description: When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0257.html - https://
tional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0257.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614
CVE ID: CVE-2017-2615 State: PUBLISHED Published: 2018-07-02T18:00:00 Last Updated: 2024-08-05T14:02:06.484Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: qemu Products: display Problem Types: CWE-787 Description: Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host. Additional Analyst Notes: - CVE Program Container: References: -
n the host with privileges of QEMU process on the host. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0329.html - http://rhn.redhat.com/errata/RHSA-2017-0334.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2615 - http://www.securitytracker.com/id/1037804 - http://rhn.redhat.com/errata/RHSA-2017-0328.html - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - http://www.securityfocus.com/bid/95990 - http://rhn.redhat.com/errata/RHSA-2017-0333.html - https://security.gentoo.org/glsa/201702-27 - http://www.openwall.com/lists/oss-security/2017/02/01/6 - http://rhn.redhat.com/errata/RHSA-2017-0454.html - https:/
7 - http://www.openwall.com/lists/oss-security/2017/02/01/6 - http://rhn.redhat.com/errata/RHSA-2017-0454.html - https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg00015.html - http://rhn.redhat.com/errata/RHSA-2017-0331.html - https://security.gentoo.org/glsa/201702-28 - http://rhn.redhat.com/errata/RHSA-2017-0350.html - http://rhn.redhat.com/errata/RHSA-2017-0396.html - http://rhn.redhat.com/errata/RHSA-2017-0309.html - http://rhn.redhat.com/errata/RHSA-2017-0344.html - http://rhn.redhat.com/errata/RHSA-2017-0330.html - http://rhn.redhat.com/errata/RHSA-2017-0332.html - https://support.citrix.com/article/CTX220771
CVE ID: CVE-2017-2616 State: PUBLISHED Published: 2018-07-27T19:00:00.000Z Last Updated: 2025-06-09T15:37:51.878Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Linux Products: util-linux Problem Types: CWE-267 Description: A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2616 - http://www.securityfocus.com/bid/96404 - https://access.
: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2616 - http://www.securityfocus.com/bid/96404 - https://access.redhat.com/errata/RHSA-2017:0907 - http://rhn.redhat.com/errata/RHSA-2017-0654.html - https://security.gentoo.org/glsa/201706-02 - https://www.debian.org/security/2017/dsa-3793 - https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891 - http://www.securitytracker.com/id/1038271
CVE ID: CVE-2017-2617 State: PUBLISHED Published: 2018-05-22T17:00:00 Last Updated: 2024-08-05T14:02:06.951Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: [UNKNOWN] Products: hawtio Problem Types: CWE-20 Description: hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which could be executed on a target machine where hawtio is deployed. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2617 - https://access.redhat.com/errata/RHSA-2018:0319 - http://www.securityfocus.com/bid/96036
CVE ID: CVE-2017-2618 State: PUBLISHED Published: 2018-07-27T19:00:00 Last Updated: 2024-08-05T14:02:07.208Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Linux Products: kernel Problem Types: CWE-193 Description: A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10. An empty (null) write to this file can crash the system by causing the system to attempt to access unmapped kernel memory. Additional Analyst Notes: - CVE Program Container: References: - https://marc.info/?l=selinux&m=148588165923772&w=2 - https://www.debian.org/security/2017/dsa-3791 - https://bugzilla.redhat.com/show_bug.cgi?id
inux&m=148588165923772&w=2 - https://www.debian.org/security/2017/dsa-3791 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2618 - https://access.redhat.com/errata/RHSA-2017:0932 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0c461cb727d146c9ef2d3e86214f498b78b7d125 - https://access.redhat.com/errata/RHSA-2017:0933 - https://access.redhat.com/errata/RHSA-2017:0931 - http://www.securityfocus.com/bid/96272
CVE ID: CVE-2017-2619 State: PUBLISHED Published: 2018-03-12T15:00:00Z Last Updated: 2024-09-17T00:45:45.569Z Vendors: Samba Products: samba Problem Types: CWE-362 Description: Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:2778 - https://www.debian.org/security/2017/dsa-3816 - http://www.securityfocus.com/bid/97033 - https://www.exploit-db.com/exploits/41740/ - http://www.securitytracker.com/id/1038117 - https://access.redhat.com/errata/R
ps://www.exploit-db.com/exploits/41740/ - http://www.securitytracker.com/id/1038117 - https://access.redhat.com/errata/RHSA-2017:2338 - https://www.samba.org/samba/security/CVE-2017-2619.html - https://bugzilla.redhat.com/show_bug.cgi?id=1429472 - https://access.redhat.com/errata/RHSA-2017:1265 - https://access.redhat.com/errata/RHSA-2017:2789 - https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03755en_us
CVE ID: CVE-2017-2620 State: PUBLISHED Published: 2018-07-27T19:00:00 Last Updated: 2024-08-05T14:02:07.311Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: QEMU Products: Qemu: Problem Types: CWE-787 Description: Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.c
ith privileges of the QEMU process. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2017-0329.html - http://rhn.redhat.com/errata/RHSA-2017-0334.html - http://www.securitytracker.com/id/1037870 - http://rhn.redhat.com/errata/RHSA-2017-0328.html - https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html - http://rhn.redhat.com/errata/RHSA-2017-0333.html - http://rhn.redhat.com/errata/RHSA-2017-0351.html - http://rhn.redhat.com/errata/RHSA-2017-0454.html - https://xenbits.xen.org/xsa/advisory-209.html - http://rhn.redhat.com/errata/RHSA-2017-0331.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620 - http://www.openwall.c
edhat.com/errata/RHSA-2017-0331.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2620 - http://www.openwall.com/lists/oss-security/2017/02/21/1 - http://rhn.redhat.com/errata/RHSA-2017-0350.html - https://lists.debian.org/debian-lts-announce/2018/02/msg00005.html - http://rhn.redhat.com/errata/RHSA-2017-0396.html - https://security.gentoo.org/glsa/201704-01 - https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html - http://rhn.redhat.com/errata/RHSA-2017-0352.html - http://rhn.redhat.com/errata/RHSA-2017-0330.html - http://rhn.redhat.com/errata/RHSA-2017-0332.html - http://www.securityfocus.com/bid/96378 - https://support.citrix.com/article/CTX220771 - https://security
017-0332.html - http://www.securityfocus.com/bid/96378 - https://support.citrix.com/article/CTX220771 - https://security.gentoo.org/glsa/201703-07
CVE ID: CVE-2017-2621 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:06.948Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: Red Hat Products: openstack-heat Problem Types: CWE-552 Description: An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2621 - https://access.redhat.com/errata/RHSA-2017:1243 - https://a
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2621 - https://access.redhat.com/errata/RHSA-2017:1243 - https://access.redhat.com/errata/RHSA-2017:1464 - http://www.securityfocus.com/bid/96280
CVE ID: CVE-2017-2622 State: PUBLISHED Published: 2018-07-27T13:00:00 Last Updated: 2024-08-05T14:02:06.918Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: openstack-mistral Problem Types: CWE-552 Description: An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2622 - https://access.redhat.com/errata/RHSA-2017:1584
CVE ID: CVE-2017-2623 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.178Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: Project Atomic Products: rpm-ostree, Problem Types: CWE-295 Description: It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail to be rejected as expected. This issue is partially mitigated on RHEL Atomic Host, where certificate pinning is used by default. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id
by default. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2623 - https://access.redhat.com/errata/RHSA-2017:0444 - http://www.securityfocus.com/bid/96558
CVE ID: CVE-2017-2624 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:06.893Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Xorg Products: xorg-x11-server Problem Types: CWE-385 Description: It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack. Additional Analyst Notes: - CVE Program Co
a valid and invalid byte, which could allow an efficient brute force attack. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201704-03 - https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c - http://www.securitytracker.com/id/1037919 - https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html - https://security.gentoo.org/glsa/201710-30 - http://www.securityfocus.com/bid/96480 - https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/ - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624
CVE ID: CVE-2017-2625 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:06.921Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Xorg Products: libXdmcp Problem Types: CWE-331 Description: It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys. On a multi-user system using xdmcp, a local attacker could potentially use information available from the process list to brute force the key, allowing them to hijack other users' sessions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201704-03 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-20
Container: References: - https://security.gentoo.org/glsa/201704-03 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2625 - https://access.redhat.com/errata/RHSA-2017:1865 - http://www.securitytracker.com/id/1037919 - https://cgit.freedesktop.org/xorg/lib/libXdmcp/commit/?id=0554324ec6bbc2071f5d1f8ad211a1643e29eb1f - http://www.securityfocus.com/bid/96480 - https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/ - https://lists.debian.org/debian-lts-announce/2019/11/msg00024.html
CVE ID: CVE-2017-2626 State: PUBLISHED Published: 2018-07-27T19:00:00 Last Updated: 2024-08-05T14:02:06.904Z Severity: MEDIUM (CVSS 5.2 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L) Vendors: Xorg Products: libICE Problem Types: CWE-331 Description: It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list. Additional Analyst Notes: - CVE Program Container: References: - https://cgit.freedesktop.org/xorg/lib/libICE/commit/?id=ff5e59f32255913bb1cdf51441b98c9107ae165b - https://security.gentoo.org/glsa/201704-03 - https://bugzilla.redhat.com/show_
f5e59f32255913bb1cdf51441b98c9107ae165b - https://security.gentoo.org/glsa/201704-03 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2626 - https://access.redhat.com/errata/RHSA-2017:1865 - http://www.securitytracker.com/id/1037919 - http://www.securityfocus.com/bid/96480 - https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/ - http://www.openwall.com/lists/oss-security/2019/07/14/3 - https://lists.debian.org/debian-lts-announce/2019/11/msg00022.html
CVE ID: CVE-2017-2627 State: PUBLISHED Published: 2018-08-22T17:00:00 Last Updated: 2024-08-05T14:02:06.902Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: openstack-tripleo-common Problem Types: CWE-22 Description: A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal with '..' and it grants full passwordless root access to the validations user. Additional Analyst Notes: - CVE Program Container: Refere
grants full passwordless root access to the validations user. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2627