Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-0482 State: PUBLISHED Published: 2019-01-10T17:00:00Z Last Updated: 2024-11-21T19:49:29.261Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Prime Network Control System Problem Types: CWE-79 Description: A vulnerability in the web-based management interface of Cisco Prime Network Control System could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of the affected system. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vul
n of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web-based management interface or allow the attacker to access sensitive browser-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-pnc-stored-xss - http://www.securityfocus.com/bid/106514
CVE ID: CVE-2018-0483 State: PUBLISHED Published: 2019-01-10T17:00:00Z Last Updated: 2024-11-21T19:49:20.384Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Cisco Products: Cisco Jabber IM for Android Problem Types: CWE-79 Description: A vulnerability in Cisco Jabber Client Framework (JCF) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient validation of user-supplied input of an affected client. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. A successful exploit could
this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. A successful exploit could allow the attacker to execute arbitrary script code in the context of the targeted client or allow the attacker to access sensitive client-based information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.securityfocus.com/bid/106506 - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-jcf-im-xss
CVE ID: CVE-2018-0484 State: PUBLISHED Published: 2019-01-10T18:00:00Z Last Updated: 2024-11-19T19:18:45.475Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Cisco Products: Cisco IOS Problem Types: CWE-284 Description: A vulnerability in the access control logic of the Secure Shell (SSH) server of Cisco IOS and IOS XE Software may allow connections sourced from a virtual routing and forwarding (VRF) instance despite the absence of the vrf-also keyword in the access-class configuration. The vulnerability is due to a missing check in the SSH server. An attacker could use this vulnerability to open an SSH connection to an affected Cisco IOS or IOS XE device wi
server. An attacker could use this vulnerability to open an SSH connection to an affected Cisco IOS or IOS XE device with a source address belonging to a VRF instance. Once connected, the attacker would still need to provide valid credentials to access the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ios-ssh-vrf - http://www.securityfocus.com/bid/106560
CVE ID: CVE-2018-0485 State: PUBLISHED Published: 2018-10-05T14:00:00Z Last Updated: 2024-11-26T14:36:42.021Z Vendors: Cisco Products: Cisco IOS Software Problem Types: CWE-19 Description: A vulnerability in the SM-1T3/E3 firmware on Cisco Second Generation Integrated Services Routers (ISR G2) and the Cisco 4451-X Integrated Services Router (ISR4451-X) could allow an unauthenticated, remote attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a denial of service (DoS) condition on an affected device. The vulnerability is due to improper handling of user input. An attacker could exploit this vulnerability by first connecting to the SM-1T3/E3 mod
o improper handling of user input. An attacker could exploit this vulnerability by first connecting to the SM-1T3/E3 module console and entering a string sequence. A successful exploit could allow the attacker to cause the ISR G2 Router or the SM-1T3/E3 module on the ISR4451-X to reload, resulting in a DoS condition on an affected device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180926-sm1t3e3 - http://www.securitytracker.com/id/1041737 - http://www.securitytracker.com/id/1041736 - http://www.securityfocus.com/bid/105433
CVE ID: CVE-2018-0486 State: PUBLISHED Published: 2018-01-13T18:00:00 Last Updated: 2024-08-05T03:28:11.047Z Vendors: n/a Products: XMLTooling-C before 1.6.3 Problem Types: mishandles digital signatures Description: Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products, mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4085 - https://lists.debian.org/debian-security-announce/2018/msg00007.html - https://shi
w.debian.org/security/2018/dsa-4085 - https://lists.debian.org/debian-security-announce/2018/msg00007.html - https://shibboleth.net/community/advisories/secadv_20180112.txt - https://lists.debian.org/debian-lts-announce/2018/01/msg00016.html - http://www.securitytracker.com/id/1040177
CVE ID: CVE-2018-0487 State: PUBLISHED Published: 2018-02-13T15:00:00 Last Updated: 2024-08-05T03:28:11.092Z Vendors: n/a Products: ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 Problem Types: buffer overflow Description: ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via a crafted certificate chain that is mishandled during RSASSA-PSS signature verification within a TLS or DTLS session. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4147 - https://www.debian.org/security/2018/dsa-4138 - https://tls.mbed.org/tec
https://www.debian.org/security/2018/dsa-4147 - https://www.debian.org/security/2018/dsa-4138 - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01 - http://www.securityfocus.com/bid/103056 - https://security.gentoo.org/glsa/201804-19 - https://usn.ubuntu.com/4267-1/
CVE ID: CVE-2018-0488 State: PUBLISHED Published: 2018-02-13T15:00:00 Last Updated: 2024-08-05T03:28:11.050Z Vendors: n/a Products: ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0 Problem Types: heap corruption Description: ARM mbed TLS before 1.3.22, before 2.1.10, and before 2.7.0, when the truncated HMAC extension and CBC are used, allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption) via a crafted application packet within a TLS or DTLS session. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/103057 - https://www.debian.org/security/2018/dsa-4147 - https://www.debian.org/security/2018
/www.securityfocus.com/bid/103057 - https://www.debian.org/security/2018/dsa-4147 - https://www.debian.org/security/2018/dsa-4138 - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-01 - https://security.gentoo.org/glsa/201804-19 - https://usn.ubuntu.com/4267-1/
CVE ID: CVE-2018-0489 State: PUBLISHED Published: 2018-02-27T15:00:00 Last Updated: 2024-08-05T03:28:11.071Z Vendors: n/a Products: Shibboleth XMLTooling-C before 1.6.4 Problem Types: obtain sensitive information or conduct impersonation attacks Description: Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other products, mishandles digital signatures of user data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via crafted XML data. NOTE: this issue exists because of an incomplete fix for CVE-2018-0486. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityt
incomplete fix for CVE-2018-0486. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1040435 - http://www.securityfocus.com/bid/103172 - https://www.debian.org/security/2018/dsa-4126 - https://shibboleth.net/community/advisories/secadv_20180227.txt - http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-003.txt - https://lists.debian.org/debian-lts-announce/2018/02/msg00031.html
CVE ID: CVE-2018-0490 State: PUBLISHED Published: 2018-03-05T15:00:00 Last Updated: 2024-08-05T03:28:10.607Z Vendors: n/a Products: Tor Problem Types: NULL pointer dereference Description: An issue was discovered in Tor before 0.2.9.15, 0.3.1.x before 0.3.1.10, and 0.3.2.x before 0.3.2.10. The directory-authority protocol-list subprotocol implementation allows remote attackers to cause a denial of service (NULL pointer dereference and directory-authority crash) via a misformatted relay descriptor that is mishandled during voting. Additional Analyst Notes: - CVE Program Container: References: - https://trac.torproject.org/projects/tor/ticket/25074 - https://www.debian.org/security/2018/dsa-41
ainer: References: - https://trac.torproject.org/projects/tor/ticket/25074 - https://www.debian.org/security/2018/dsa-4183 - https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915
CVE ID: CVE-2018-0491 State: PUBLISHED Published: 2018-03-05T15:00:00 Last Updated: 2024-08-05T03:28:10.940Z Vendors: n/a Products: Tor Problem Types: use-after-free Description: A use-after-free issue was discovered in Tor 0.3.2.x before 0.3.2.10. It allows remote attackers to cause a denial of service (relay crash) because the KIST implementation allows a channel to be added more than once in the pending list. Additional Analyst Notes: - CVE Program Container: References: - https://trac.torproject.org/projects/tor/ticket/24700 - https://trac.torproject.org/projects/tor/ticket/25117 - https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 - h
cket/25117 - https://blog.torproject.org/new-stable-tor-releases-security-fixes-and-dos-prevention-03210-03110-02915 - https://www.exploit-db.com/exploits/44994/
CVE ID: CVE-2018-0492 State: PUBLISHED Published: 2018-04-03T07:00:00 Last Updated: 2024-08-05T03:28:10.587Z Vendors: n/a Products: beep Problem Types: race Description: Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44452/ - https://www.debian.org/security/2018/dsa-4163 - https://security-tracker.debian.org/tracker/CVE-2018-0492 - https://lists.debian.org/debian-security-announce/2018/msg00089.html - https://lists.debian.org/debian-lts-announce/2018/04/msg00002.html - https://security.gentoo.org/glsa/201805-15
CVE ID: CVE-2018-0493 State: PUBLISHED Published: 2018-04-03T07:00:00 Last Updated: 2024-08-05T03:28:10.664Z Vendors: n/a Products: remctl Problem Types: Use after free, double free Description: remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution. Additional Analyst Notes: - CVE Program Container: References: - https://git.eyrie.org/?p=kerberos/remctl.git%3Ba=commit%3Bh=86c7e44090c988112a37589d2c7a94029eb5e641 - https://www.debian.org/security/2018/dsa-4159 - https://www.eyrie.org/~eagle/software/remctl/security/2018-04-01.html
CVE ID: CVE-2018-0494 State: PUBLISHED Published: 2018-05-06T22:00:00 Last Updated: 2024-08-05T03:28:10.610Z Vendors: n/a Products: WGet Problem Types: cookie injection Description: GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line. Additional Analyst Notes: - CVE Program Container: References: - https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt - https://access.redhat.com/errata/RHSA-2018:3052 - https://savannah.gnu.org/bugs/?53763 - https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd - https://security.gentoo.org/glsa/201806-01 - https://www.
wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd - https://security.gentoo.org/glsa/201806-01 - https://www.debian.org/security/2018/dsa-4195 - http://www.securityfocus.com/bid/104129 - http://www.securitytracker.com/id/1040838 - https://www.exploit-db.com/exploits/44601/ - https://usn.ubuntu.com/3643-2/ - https://lists.debian.org/debian-lts-announce/2018/05/msg00006.html - https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html - https://usn.ubuntu.com/3643-1/
CVE ID: CVE-2018-0495 State: PUBLISHED Published: 2018-06-13T23:00:00 Last Updated: 2024-08-05T03:28:10.586Z Vendors: n/a Products: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 Problem Types: side-channel attack Description: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. Additional Analyst Notes: - CVE Pro
o either the local machine or a different virtual machine on the same physical host. Additional Analyst Notes: - CVE Program Container: References: - https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git%3Ba=commit%3Bh=9010d1576e278a4274ad3f4aa15776c28f6ba965 - http://www.securitytracker.com/id/1041144 - https://usn.ubuntu.com/3850-1/ - http://www.securitytracker.com/id/1041147 - https://www.nccgroup.trust/us/our-research/technical-advisory-return-of-the-hidden-number-problem/ - https://usn.ubuntu.com/3689-1/ - https://lists.gnupg.org/pipermail/gnupg-announce/2018q2/000426.html - https://usn.ubuntu.com/3689-2/ - https://usn.ubuntu.com/3692-2/ - https://lists.debian.org/debian-lts-announce
26.html - https://usn.ubuntu.com/3689-2/ - https://usn.ubuntu.com/3692-2/ - https://lists.debian.org/debian-lts-announce/2018/06/msg00013.html - https://www.debian.org/security/2018/dsa-4231 - https://access.redhat.com/errata/RHSA-2018:3505 - https://usn.ubuntu.com/3850-2/ - https://usn.ubuntu.com/3692-1/ - https://access.redhat.com/errata/RHSA-2018:3221 - https://dev.gnupg.org/T4011 - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://access.redhat.com/errata/RHSA-2019:1297 - https://access.redhat.com/errata/RHSA-2019:1296 - https://access.redhat.com/errata/RHSA-2019:1543 - https://access.redhat.com/errata/RHSA-2019:2237
CVE ID: CVE-2018-0496 State: PUBLISHED Published: 2018-06-12T20:00:00 Last Updated: 2024-08-05T03:28:10.955Z Vendors: n/a Products: DFArc2 before 3.14 unknown Problem Types: Directory traversal Description: Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft's Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user's system. Additional Analyst Notes: - CVE Program Container: References: - https://savannah.gnu.org/forum/forum.php?forum_id=9169 - https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998 - https://lists.debian.org/debian-lts-announce/2019/
edink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998 - https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html
CVE ID: CVE-2018-0497 State: PUBLISHED Published: 2018-07-28T17:00:00 Last Updated: 2024-08-05T03:28:11.012Z Vendors: n/a Products: ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 Problem Types: plaintext recovery Description: ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows remote attackers to achieve partial plaintext recovery (for a CBC based ciphersuite) via a timing-based side-channel attack. This vulnerability exists because of an incorrect fix (with a wrong SHA-384 calculation) for CVE-2013-0169. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html - https://www.debian.org/secu
ontainer: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html - https://www.debian.org/security/2018/dsa-4296 - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 - https://usn.ubuntu.com/4267-1/
CVE ID: CVE-2018-0498 State: PUBLISHED Published: 2018-07-28T17:00:00 Last Updated: 2024-08-05T03:28:10.856Z Vendors: n/a Products: ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 Problem Types: plaintext recovery Description: ARM mbed TLS before 2.12.0, before 2.7.5, and before 2.1.14 allows local users to achieve partial plaintext recovery (for a CBC based ciphersuite) via a cache-based side-channel attack. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2018/09/msg00029.html - https://www.debian.org/security/2018/dsa-4296 - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 - htt
g/security/2018/dsa-4296 - https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2018-02 - https://usn.ubuntu.com/4267-1/
CVE ID: CVE-2018-0499 State: PUBLISHED Published: 2018-07-02T12:00:00 Last Updated: 2024-08-05T03:28:10.931Z Vendors: n/a Products: Xapian xapian-core before 1.4.6 Problem Types: XSS Description: A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). Additional Analyst Notes: - CVE Program Container: References: - https://trac.xapian.org/wiki/SecurityFixes/2018-07-02 - https://usn.ubuntu.com/3709-1/ - https://lists.xapian.org/pipermail/xapian-discuss/2018-July/009652.html
CVE ID: CVE-2018-0500 State: PUBLISHED Published: 2018-07-11T13:00:00 Last Updated: 2024-08-05T03:28:11.048Z Vendors: n/a Products: curl before 7.61.0 Problem Types: heap-based buffer overflow Description: Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value). Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1041280 - https://github.com/curl/curl/commit/ba1dbd78e5f1ed67c1b8d37ac89d90e5e330b62
http://www.securitytracker.com/id/1041280 - https://github.com/curl/curl/commit/ba1dbd78e5f1ed67c1b8d37ac89d90e5e330b628 - https://curl.haxx.se/docs/adv_2018-70a2.html - https://security.gentoo.org/glsa/201807-04 - https://access.redhat.com/errata/RHSA-2018:2486 - https://usn.ubuntu.com/3710-1/
CVE ID: CVE-2018-0501 State: PUBLISHED Published: 2018-08-21T00:00:00 Last Updated: 2024-08-05T03:28:10.583Z Vendors: n/a Products: APT 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 Problem Types: lack of signature verification Description: The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail. Additional Analyst Notes: - CVE Program Container: References: - https://mirror.fail - https://usn.ubuntu.com/3746-1/ - https://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47 - https://salsa.debian.org/apt-team
ttps://salsa.debian.org/apt-team/apt/commit/aebd4278bacc728ab00ebe31556983e140f60e47 - https://salsa.debian.org/apt-team/apt/commit/29658a3a74af49e2a24e17bdebb20e1612aac3ec
CVE ID: CVE-2018-0502 State: PUBLISHED Published: 2018-09-05T07:00:00 Last Updated: 2024-08-05T03:28:11.019Z Vendors: n/a Products: zsh before 5.6 Problem Types: improper parsing Description: An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/908000 - https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d - https://www.zsh.org/mla/zsh-announce/136 - https://usn.ubuntu.com/3764-1/ - https://security.gentoo.org/glsa/201903-02 - https://lists.debian.org/debian-lts-an
6 - https://usn.ubuntu.com/3764-1/ - https://security.gentoo.org/glsa/201903-02 - https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
CVE ID: CVE-2018-0503 State: PUBLISHED Published: 2018-10-04T20:00:00Z Last Updated: 2024-09-17T01:30:58.026Z Vendors: mediawiki Products: mediawiki Problem Types: Improper imlementation of documentation / spec Description: Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html - http://www.securitytracker.com/id/1041695 - https://phabricator.wikimedia.org/T169545 - https://www.debian.org/security/2018/dsa-4301 - https://access.redhat.com/er
https://phabricator.wikimedia.org/T169545 - https://www.debian.org/security/2018/dsa-4301 - https://access.redhat.com/errata/RHSA-2019:3142 - https://access.redhat.com/errata/RHSA-2019:3238 - https://access.redhat.com/errata/RHSA-2019:3813
CVE ID: CVE-2018-0504 State: PUBLISHED Published: 2018-10-04T20:00:00Z Last Updated: 2024-09-17T00:41:51.974Z Vendors: mediawiki Products: mediawiki Problem Types: Information disclosure Description: Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html - http://www.securitytracker.com/id/1041695 - https://phabricator.wikimedia.org/T187638 - https://www.debian.org/security/2018/dsa-4301 - https://access.redhat.com/errata/RHSA-2019:3238 - https://access.redhat.com/errata/RHSA-2019:38
security/2018/dsa-4301 - https://access.redhat.com/errata/RHSA-2019:3238 - https://access.redhat.com/errata/RHSA-2019:3813
CVE ID: CVE-2018-0505 State: PUBLISHED Published: 2018-10-04T20:00:00Z Last Updated: 2024-09-16T18:48:38.021Z Vendors: mediawiki Products: mediawiki Problem Types: Authentication bypass Description: Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock Additional Analyst Notes: - CVE Program Container: References: - https://lists.wikimedia.org/pipermail/wikitech-l/2018-September/090849.html - https://phabricator.wikimedia.org/T194605 - http://www.securitytracker.com/id/1041695 - https://www.debian.org/security/2018/dsa-4301 - https://access.redhat.com/errata/RHSA-2019:3142 - https://access.redhat.com/errata/RHSA-2019:
g/security/2018/dsa-4301 - https://access.redhat.com/errata/RHSA-2019:3142 - https://access.redhat.com/errata/RHSA-2019:3238 - https://access.redhat.com/errata/RHSA-2019:3813