Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
t addresses this issue at this time. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21 - http://www.securitytracker.com/id/1038779 - http://www.securityfocus.com/bid/99252 - https://access.redhat.com/security/cve/CVE-2017-1000369 - https://security.gentoo.org/glsa/201709-19 - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - http://www.debian.org/security/2017/dsa-3888
CVE ID: CVE-2017-1000370 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:39.962Z Vendors: n/a Products: n/a Problem Types: n/a Description: The offset2lib patch as used in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'ed with 1GB of arguments or environmental strings then the stack occupies the address 0x80000000 and the PIE binary is mapped above 0x40000000 nullifying the protection of the offset2lib patch. This affects Linux Kernel version 4.11.5 and earlier. This is a different issue than CVE-2017-1000371. This issue appears to be limited to i386 based systems. Additional Analyst Notes: - CVE Program Container: References:
. This issue appears to be limited to i386 based systems. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99149 - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - http://www.debian.org/security/2017/dsa-3981 - https://www.exploit-db.com/exploits/42273/ - https://www.exploit-db.com/exploits/42274/ - https://access.redhat.com/security/cve/CVE-2017-1000370
CVE ID: CVE-2017-1000371 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:40.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: The offset2lib patch as used by the Linux Kernel contains a vulnerability, if RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated (the maximum under the 1/4 restriction) then the stack will be grown down to 0x80000000, and as the PIE binary is mapped above 0x80000000 the minimum distance between the end of the PIE binary's read-write segment and the start of the stack becomes small enough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a d
nough that the stack guard page can be jumped over by an attacker. This affects Linux Kernel version 4.11.5. This is a different issue than CVE-2017-1000370 and CVE-2017-1000365. This issue appears to be limited to i386 based systems. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - http://www.securityfocus.com/bid/99131 - http://www.debian.org/security/2017/dsa-3981 - https://www.exploit-db.com/exploits/42276/ - https://www.exploit-db.com/exploits/42273/ - https://access.redhat.com/security/cve/CVE-2017-1000371
CVE ID: CVE-2017-1000372 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:41.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - http://www.securityfocus.com/bid/99172 - https://ftp.openbsd.org/pub/OpenBSD/patches/6.1/common/008_exec_subr.patch.sig
CVE ID: CVE-2017-1000373 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:40.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects OpenBSD 6.1 and possibly earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42271/ - https://support.apple.com/HT208
tes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42271/ - https://support.apple.com/HT208144 - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/qsort.c?rev=1.15&content-type=text/x-cvsweb-markup - http://www.securityfocus.com/bid/99177 - http://www.securitytracker.com/id/1039427 - https://support.apple.com/HT208113 - https://support.apple.com/HT208112 - https://support.apple.com/HT208115
CVE ID: CVE-2017-1000374 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:41.244Z Vendors: n/a Products: n/a Problem Types: n/a Description: A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - http://www.securityfocus.com/bid/99176
CVE ID: CVE-2017-1000375 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:39.876Z Vendors: n/a Products: n/a Problem Types: n/a Description: NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/42272/ - http://www.securityfocus.com/bid/99257 - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
CVE ID: CVE-2017-1000376 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:41.083Z Vendors: n/a Products: n/a Problem Types: n/a Description: libffi requests an executable stack allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. Please note that libffi is used by a number of other libraries. It was previously stated that this affects libffi version 3.2.1 but this appears to be incorrect. libffi prior to version 3.1 on 32 bit x86 systems was vulnerable, and upstream is believed to have fixed this issue in version 3.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualys.com/2017/06/19/stack-c
version 3.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - https://access.redhat.com/security/cve/CVE-2017-1000376 - http://www.debian.org/security/2017/dsa-3889 - https://www.oracle.com/security-alerts/cpujan2020.html
CVE ID: CVE-2017-1000377 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:40.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the size of the default stack guard page on PAX Linux (originally from GRSecurity but shipped by other Linux vendors), specifically the default stack guard page is not sufficiently large and can be "jumped" over (the stack guard page is bypassed), this affects PAX Linux Kernel versions as of June 19, 2017 (specific version information is not available at this time). Additional Analyst Notes: - CVE Program Container: References: - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - http
alyst Notes: - CVE Program Container: References: - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - https://access.redhat.com/security/cve/CVE-2017-1000377 - http://www.securityfocus.com/bid/99129
CVE ID: CVE-2017-1000378 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:41.543Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NetBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N elements that causes qsort() to deterministically recurse N/4 times. This allows attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks. This affects NetBSD 7.1 and possibly earlier versions. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/99255 - https://www.qualys.com/2017/06/19/sta
s: - CVE Program Container: References: - http://www.securityfocus.com/bid/99255 - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/qsort.c?rev=1.23&content-type=text/x-cvsweb-markup
CVE ID: CVE-2017-1000379 State: PUBLISHED Published: 2017-06-19T16:00:00 Last Updated: 2024-08-05T22:00:40.913Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1491 - https://access.redhat.com/errata/RHSA-2017:1486 - https://access.redhat.com/errata/RHSA-2017:1489 - https://access.redhat.com/errata/RHSA-2017:1490 - https://access.redhat.com/s
/access.redhat.com/errata/RHSA-2017:1489 - https://access.redhat.com/errata/RHSA-2017:1490 - https://access.redhat.com/security/cve/CVE-2017-1000379 - https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt - https://access.redhat.com/errata/RHSA-2017:1482 - https://access.redhat.com/errata/RHSA-2017:1647 - http://www.securityfocus.com/bid/99284 - https://www.exploit-db.com/exploits/42275/ - https://access.redhat.com/errata/RHSA-2017:1616 - https://access.redhat.com/errata/RHSA-2017:1712 - https://access.redhat.com/errata/RHSA-2017:1487 - https://access.redhat.com/errata/RHSA-2017:1484 - https://access.redhat.com/errata/RHSA-2017:1842 - https://access.redhat.com/errata/RHSA-2017:1485 -
ata/RHSA-2017:1484 - https://access.redhat.com/errata/RHSA-2017:1842 - https://access.redhat.com/errata/RHSA-2017:1485 - https://access.redhat.com/errata/RHSA-2017:1488
CVE ID: CVE-2017-1000380 State: PUBLISHED Published: 2017-06-17T18:00:00 Last Updated: 2024-08-05T22:00:39.924Z Vendors: n/a Products: n/a Problem Types: n/a Description: sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3315 - https://access.redhat.com/errata/RHSA-2017:3322 - https://access.redhat.com/errata/RHSA-2017:3295 - http://www.ke
3315 - https://access.redhat.com/errata/RHSA-2017:3322 - https://access.redhat.com/errata/RHSA-2017:3295 - http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5 - https://github.com/torvalds/linux/commit/ba3021b2c79b2fa9114f92790a99deb27a65b728 - http://www.openwall.com/lists/oss-security/2017/06/12/2 - http://www.debian.org/security/2017/dsa-3981 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ba3021b2c79b2fa9114f92790a99deb27a65b728 - https://source.android.com/security/bulletin/pixel/2017-12-01 - https://github.com/torvalds/linux/commit/d11662f4f798b50d8c8743f433842c3e40fe3378 - http://www.securityfocus.com/bid/99121 - http://git.kernel.org/cgit/linux/ke
/d11662f4f798b50d8c8743f433842c3e40fe3378 - http://www.securityfocus.com/bid/99121 - http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d11662f4f798b50d8c8743f433842c3e40fe3378
CVE ID: CVE-2017-1000381 State: PUBLISHED Published: 2017-07-07T17:00:00 Last Updated: 2024-08-05T22:00:40.967Z Vendors: n/a Products: n/a Problem Types: n/a Description: The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way. Additional Analyst Notes: - CVE Program Container: References: - https://c-ares.haxx.se/0616.patch - http://www.securityfocus.com/bid/99148 - https://c-ares.haxx.se/adv_20170620.html
CVE ID: CVE-2017-1000382 State: PUBLISHED Published: 2017-10-31T20:00:00 Last Updated: 2024-08-05T22:00:41.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: VIM version 8.0.1187 (and other versions most likely) ignores umask when creating a swap file ("[ORIGINAL_FILENAME].swp") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the vi binary. Additional Analyst Notes: - CVE Program Container: References: - http://security.cucumberlinux.com/security/details.php?id=120 - http://www.openwall.com/lists/oss-security/2017/10/31/1
CVE ID: CVE-2017-1000383 State: PUBLISHED Published: 2017-10-31T20:00:00 Last Updated: 2024-08-05T22:00:41.080Z Vendors: n/a Products: n/a Problem Types: n/a Description: GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2017/10/31/1 - http://www.securityfocus.com/bid/101671
CVE ID: CVE-2017-1000384 State: REJECTED Published: 2017-12-15T10:00:00 Last Updated: 2017-12-15T09:57:01 Description: No description available.
CVE ID: CVE-2017-1000385 State: PUBLISHED Published: 2017-12-12T21:00:00 Last Updated: 2024-08-05T22:00:39.950Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack). Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3571-1/ - https://access.redhat.com/errata/RHSA-2018:0528 - http://erlang.org/pipermail/erlang-questions/2017-November/094257.html - https://lists.debian.org/debian-lts-announce/2017
tp://erlang.org/pipermail/erlang-questions/2017-November/094257.html - https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html - https://access.redhat.com/errata/RHSA-2018:0242 - https://robotattack.org/ - http://erlang.org/pipermail/erlang-questions/2017-November/094256.html - https://www.debian.org/security/2017/dsa-4057 - https://access.redhat.com/errata/RHSA-2018:0368 - https://access.redhat.com/errata/RHSA-2018:0303 - http://erlang.org/pipermail/erlang-questions/2017-November/094255.html - http://www.securityfocus.com/bid/102197 - https://www.kb.cert.org/vuls/id/144389
CVE ID: CVE-2017-1000386 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:41.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Active Choices now sanitizes the HTML inserted on the 'Build With Parameters' page if and only if the script is executed in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow
uted in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow or disallow problematic script output. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-23/ - http://www.securityfocus.com/bid/101538
CVE ID: CVE-2017-1000387 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:41.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and si
his could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-23/ - http://www.securityfocus.com/bid/101544
CVE ID: CVE-2017-1000388 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:41.036Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Dependency Graph Viewer plugin 0.12 and earlier did not perform permission checks for the API endpoint that modifies the dependency graph, allowing anyone with Overall/Read permission to modify this data. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-23/
CVE ID: CVE-2017-1000389 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:41.204Z Vendors: n/a Products: n/a Problem Types: n/a Description: Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting vulnerability. Additionally, some URLs provided by global-build-stats plugin that modify data did not require POST requests to be sent, resulting in a potential cross-site request forgery vulnerability. Additional Analyst Notes: - CV
T requests to be sent, resulting in a potential cross-site request forgery vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-23/
CVE ID: CVE-2017-1000390 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:41.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the build. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-23/ - http://www.securityfocus.com/bid/102824
CVE ID: CVE-2017-1000391 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:41.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101773 - https://jenkins.io/security/advisory
s: - CVE Program Container: References: - http://www.securityfocus.com/bid/101773 - https://jenkins.io/security/advisory/2017-11-08/
CVE ID: CVE-2017-1000392 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:40.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102826 - http://www.securityfocus.com/bid/101773 - https://jenkins.io/security/advisory/2017-11-08/
CVE ID: CVE-2017-1000393 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:40.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of this launch method now requires the Run Scripts permission typically only granted to administrators. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/adv
nted to administrators. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-11/
CVE ID: CVE-2017-1000394 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:40.783Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jenkins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-11/
CVE ID: CVE-2017-1000395 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:40.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/(username)/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote API now no longer includes information beyond the most basic (user ID and name) unless the user requesting it is a Jenkins administrator. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/securit
is a Jenkins administrator. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-11/
CVE ID: CVE-2017-1000396 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:39.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as a transitive dependency in Jenkins plugins. The fix for CVE-2012-6153 was backported to the version of commons-httpclient that is bundled in core and made available to plugins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/securit
d made available to plugins. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-11/
CVE ID: CVE-2017-1000397 State: PUBLISHED Published: 2018-01-26T02:00:00 Last Updated: 2024-08-05T22:00:41.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer has a dependency on commons-httpclient. Additional Analyst Notes: - CVE Program Container: References: - https://jenkins.io/security/advisory/2017-10-11/